zizmor 1.16.0__tar.gz → 1.16.1__tar.gz

{zizmor-1.16.0 → zizmor-1.16.1}/Cargo.lock

@@ -3739,7 +3739,7 @@ checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
 
 [[package]]
 name = "yamlpatch"
-version = "0.3.1"
+version = "0.4.0"
 dependencies = [
  "indexmap",
  "insta",
@@ -3879,7 +3879,7 @@ dependencies = [
 
 [[package]]
 name = "zizmor"
-version = "1.16.0"
+version = "1.16.1"
 dependencies = [
  "annotate-snippets",
  "anstream",

{zizmor-1.16.0 → zizmor-1.16.1}/Cargo.toml

@@ -65,7 +65,7 @@ tree-sitter-bash = "0.25.0"
 tree-sitter-iter = { path = "crates/tree-sitter-iter", version = "0.0.2" }
 tree-sitter-powershell = "0.25.9"
 yamlpath = { path = "crates/yamlpath", version = "0.27.0" }
-yamlpatch = { path = "crates/yamlpatch", version = "0.3.1" }
+yamlpatch = { path = "crates/yamlpatch", version = "0.4.0" }
 tree-sitter-yaml = "0.7.2"
 tikv-jemallocator = "0.6"
 

{zizmor-1.16.0 → zizmor-1.16.1}/PKG-INFO

@@ -1,10 +1,15 @@
 Metadata-Version: 2.4
 Name: zizmor
-Version: 1.16.0
+Version: 1.16.1
 License-File: LICENSE
+Summary: Static analysis for GitHub Actions
 Home-Page: https://docs.zizmor.sh
+Author: William Woodruff <william@yossarian.net>
+Author-email: William Woodruff <william@yossarian.net>
+License: MIT
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
+Project-URL: Source Code, https://github.com/zizmorcore/zizmor
 
 # 🌈 zizmor
 

{zizmor-1.16.0 → zizmor-1.16.1}/crates/yamlpatch/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "yamlpatch"
-version = "0.3.1"
+version = "0.4.0"
 description = "Comment and format-preserving YAML patch operations"
 repository = "https://github.com/zizmorcore/zizmor/tree/main/crates/yamlpatch"
 keywords = ["yaml", "patch"]

{zizmor-1.16.0 → zizmor-1.16.1}/crates/zizmor/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "zizmor"
 description = "Static analysis for GitHub Actions"
-version = "1.16.0"
+version = "1.16.1"
 repository = "https://github.com/zizmorcore/zizmor"
 documentation = "https://docs.zizmor.sh"
 keywords = ["cli", "github-actions", "static-analysis", "security"]

{zizmor-1.16.0 → zizmor-1.16.1}/crates/zizmor/src/github.rs

@@ -148,6 +148,9 @@ pub(crate) enum ClientError {
     /// between listing and fetching it.
     #[error("couldn't fetch file {file} from {slug}: is the branch/tag being modified?")]
     FileTOCTOU { file: String, slug: String },
+    /// An accessed repository is missing or private.
+    #[error("can't access {owner}/{repo}: missing or you have no access")]
+    RepoMissingOrPrivate { owner: String, repo: String },
     /// Any of the errors above, wrapped from concurrent contexts.
     #[error(transparent)]
     Inner(#[from] Arc<ClientError>),
@@ -372,8 +375,20 @@ impl Client {
                     .body(req)
                     .basic_auth("x-access-token", Some(&self.token.0))
                     .send()
-                    .await?
-                    .error_for_status()?;
+                    .await?;
+
+                let resp = match resp.status() {
+                    StatusCode::OK => Ok(resp),
+                    // NOTE: Versions of zizmor prior to 1.16.0 would silently
+                    // skip private or missing repositories, as branch/tag lookups
+                    // were done as a binary present/absent check. This caused
+                    // false negatives.
+                    StatusCode::NOT_FOUND => Err(ClientError::RepoMissingOrPrivate {
+                        owner: owner.to_string(),
+                        repo: repo.to_string(),
+                    }),
+                    _ => Err(resp.error_for_status().unwrap_err().into()),
+                }?;
 
                 let mut remote_refs = vec![];
                 let content = resp.bytes().await?;

{zizmor-1.16.0 → zizmor-1.16.1}/crates/zizmor/src/main.rs

@@ -849,55 +849,57 @@ fn main() -> ExitCode {
 
                     Some(report)
                 }
-                Error::Collection(err @ CollectionError::InvalidInput(..)) => {
-                    let group = Group::with_title(Level::ERROR.primary_title(err.to_string()))
-                        .element(Level::HELP.message(format!(
-                            "valid inputs are files, directories, or GitHub {slug} slugs",
-                            slug = "user/repo[@ref]".green()
-                        )))
-                        .element(Level::HELP.message(format!(
-                            "examples: {ex1}, {ex2}, {ex3}, or {ex4}",
-                            ex1 = "path/to/workflow.yml".green(),
-                            ex2 = ".github/".green(),
-                            ex3 = "example/example".green(),
-                            ex4 = "example/example@v1.2.3".green()
-                        )));
-
-                    let renderer = Renderer::styled();
-                    let report = renderer.render(&[group]);
-
-                    Some(report)
-                }
-                Error::Collection(err @ CollectionError::NoGitHubClient(_)) => {
-                    let mut group = Group::with_title(Level::ERROR.primary_title(err.to_string()));
+                Error::Collection(err) => match err.inner() {
+                    CollectionError::DuplicateInput(..) => {
+                        let group = Group::with_title(Level::ERROR.primary_title(err.to_string()))
+                            .element(Level::HELP.message(format!(
+                                "valid inputs are files, directories, or GitHub {slug} slugs",
+                                slug = "user/repo[@ref]".green()
+                            )))
+                            .element(Level::HELP.message(format!(
+                                "examples: {ex1}, {ex2}, {ex3}, or {ex4}",
+                                ex1 = "path/to/workflow.yml".green(),
+                                ex2 = ".github/".green(),
+                                ex3 = "example/example".green(),
+                                ex4 = "example/example@v1.2.3".green()
+                            )));
+
+                        let renderer = Renderer::styled();
+                        let report = renderer.render(&[group]);
+
+                        Some(report)
+                    }
+                    CollectionError::NoGitHubClient(..) => {
+                        let mut group =
+                            Group::with_title(Level::ERROR.primary_title(err.to_string()));
 
-                    if app.offline {
-                        group = group
-                            .elements([Level::HELP
+                        if app.offline {
+                            group = group.elements([Level::HELP
                                 .message("remove --offline to audit remote repositories")]);
-                    } else if app.gh_token.is_none() {
-                        group = group
-                            .elements([Level::HELP
+                        } else if app.gh_token.is_none() {
+                            group = group.elements([Level::HELP
                                 .message("set a GitHub token with --gh-token or GH_TOKEN")]);
-                    }
-
-                    let renderer = Renderer::styled();
-                    let report = renderer.render(&[group]);
+                        }
 
-                    Some(report)
-                }
-                Error::Collection(err @ CollectionError::Yamlpath(_)) => {
-                    let group = Group::with_title(Level::ERROR.primary_title(err.to_string())).elements([
-                        Level::HELP.message("this typically indicates a bug in zizmor; please report it"),
-                        Level::HELP.message(
-                            "https://github.com/zizmorcore/zizmor/issues/new?template=bug-report.yml",
-                        ),
-                    ]);
-                    let renderer = Renderer::styled();
-                    let report = renderer.render(&[group]);
+                        let renderer = Renderer::styled();
+                        let report = renderer.render(&[group]);
 
-                    Some(report)
-                }
+                        Some(report)
+                    }
+                    CollectionError::Yamlpath(..) => {
+                        let group = Group::with_title(Level::ERROR.primary_title(err.to_string())).elements([
+                            Level::HELP.message("this typically indicates a bug in zizmor; please report it"),
+                            Level::HELP.message(
+                                "https://github.com/zizmorcore/zizmor/issues/new?template=bug-report.yml",
+                            ),
+                        ]);
+                        let renderer = Renderer::styled();
+                        let report = renderer.render(&[group]);
+
+                        Some(report)
+                    }
+                    _ => None,
+                },
                 _ => None,
             };
 

{zizmor-1.16.0 → zizmor-1.16.1}/crates/zizmor/src/registry/input.rs

@@ -93,6 +93,19 @@ pub(crate) enum CollectionError {
     NoInputs,
 }
 
+impl CollectionError {
+    /// Returns the "innermost" variant of this [`CollectionError`].
+    ///
+    /// In practice this is always `&self` *unless* this is an
+    /// `Inner` variant, in which case it recurses into the inner error.
+    pub(crate) fn inner(&self) -> &Self {
+        match self {
+            CollectionError::Inner(inner, _, _) => inner.inner(),
+            _ => self,
+        }
+    }
+}
+
 #[derive(Debug, Copy, Clone, Eq, Hash, PartialEq, Serialize, PartialOrd, Ord)]
 pub(crate) enum InputKind {
     /// A workflow file.

{zizmor-1.16.0 → zizmor-1.16.1}/crates/zizmor/tests/integration/e2e.rs

@@ -75,7 +75,7 @@ fn menagerie() -> Result<()> {
             .output(OutputMode::Both)
             .args(["--collect=all"])
             .input(input_under_test("e2e-menagerie"))
-            .run()?
+            .run()?,
     );
 
     Ok(())
@@ -367,3 +367,31 @@ fn issue_1207() -> Result<()> {
 
     Ok(())
 }
+
+/// Regression test for #1286.
+///
+/// Ensures that we produce a useful error when a user's input references
+/// a private (or missing) repository.
+#[cfg_attr(not(feature = "gh-token-tests"), ignore)]
+#[test]
+fn issue_1286() -> Result<()> {
+    insta::assert_snapshot!(
+        zizmor()
+            .expects_failure(true)
+            .output(OutputMode::Both)
+            .offline(false)
+            .input(input_under_test("issue-1286.yml"))
+            .run()?,
+        @r"
+    🌈 zizmor v@@VERSION@@
+    fatal: no audit was performed
+    ref-confusion failed on file://@@INPUT@@
+
+    Caused by:
+        0: couldn't list branches for woodruffw-experiments/this-does-not-exist
+        1: can't access woodruffw-experiments/this-does-not-exist: missing or you have no access
+    ",
+    );
+
+    Ok(())
+}

zizmor-1.16.1/crates/zizmor/tests/integration/test-data/issue-1286.yml

@@ -0,0 +1,19 @@
+# repro for #1286
+
+name: issue-1286-repro
+
+on: [push, pull_request]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  issue-1286-repro:
+    name: issue-1286-repro
+    runs-on: ubuntu-latest
+    steps:
+      - name: private
+        uses: woodruffw-experiments/this-does-not-exist@v1.0.0

{zizmor-1.16.0 → zizmor-1.16.1}/pyproject.toml

@@ -6,7 +6,7 @@ build-backend = "maturin"
 # `uv run --only-group docs` from failing.
 [project]
 name = "zizmor"
-dynamic = ["version", "readme"]
+dynamic = ["version", "description", "readme", "urls", "authors", "license"]
 # Arbitrarily set to the oldest non-EOL Python.
 requires-python = ">=3.9"