zizmor 1.16.1__tar.gz → 1.16.2__tar.gz

{zizmor-1.16.1 → zizmor-1.16.2}/Cargo.lock

@@ -890,7 +890,7 @@ checksum = "e629b9b98ef3dd8afe6ca2bd0f89306cec16d43d907889945bc5d6687f2f13c7"
 
 [[package]]
 name = "github-actions-expressions"
-version = "0.0.10"
+version = "0.0.11"
 dependencies = [
  "anyhow",
  "itertools",
@@ -2600,7 +2600,7 @@ dependencies = [
 
 [[package]]
 name = "subfeature"
-version = "0.0.3"
+version = "0.0.4"
 dependencies = [
  "memchr",
  "regex",
@@ -3739,7 +3739,7 @@ checksum = "fdd20c5420375476fbd4394763288da7eb0cc0b8c11deed431a91562af7335d3"
 
 [[package]]
 name = "yamlpatch"
-version = "0.4.0"
+version = "0.5.0"
 dependencies = [
  "indexmap",
  "insta",
@@ -3755,7 +3755,7 @@ dependencies = [
 
 [[package]]
 name = "yamlpath"
-version = "0.27.0"
+version = "0.28.0"
 dependencies = [
  "line-index",
  "self_cell",
@@ -3879,7 +3879,7 @@ dependencies = [
 
 [[package]]
 name = "zizmor"
-version = "1.16.1"
+version = "1.16.2"
 dependencies = [
  "annotate-snippets",
  "anstream",

{zizmor-1.16.1 → zizmor-1.16.2}/Cargo.toml

@@ -12,7 +12,7 @@ rust-version = "1.88.0"
 
 [workspace.dependencies]
 anyhow = "1.0.100"
-github-actions-expressions = { path = "crates/github-actions-expressions", version = "0.0.10" }
+github-actions-expressions = { path = "crates/github-actions-expressions", version = "0.0.11" }
 github-actions-models = { path = "crates/github-actions-models", version = "0.38.0" }
 itertools = "0.14.0"
 pest = "2.8.3"
@@ -51,7 +51,7 @@ serde-sarif = "0.8.0"
 serde_json = "1.0.145"
 serde_json_path = "0.7.2"
 serde_yaml = "0.9.34"
-subfeature = { path = "crates/subfeature", version = "0.0.3" }
+subfeature = { path = "crates/subfeature", version = "0.0.4" }
 tar = "0.4.44"
 terminal-link = "0.1.0"
 thiserror = "2.0.17"
@@ -64,8 +64,8 @@ tree-sitter = "0.25.10"
 tree-sitter-bash = "0.25.0"
 tree-sitter-iter = { path = "crates/tree-sitter-iter", version = "0.0.2" }
 tree-sitter-powershell = "0.25.9"
-yamlpath = { path = "crates/yamlpath", version = "0.27.0" }
-yamlpatch = { path = "crates/yamlpatch", version = "0.4.0" }
+yamlpath = { path = "crates/yamlpath", version = "0.28.0" }
+yamlpatch = { path = "crates/yamlpatch", version = "0.5.0" }
 tree-sitter-yaml = "0.7.2"
 tikv-jemallocator = "0.6"
 
@@ -77,6 +77,7 @@ use_debug = "warn"
 needless_lifetimes = "warn"
 print_stderr = "warn"
 print_stdout = "warn"
+unwrap_used = "warn"
 
 [profile.dev.package]
 insta.opt-level = 3

{zizmor-1.16.1 → zizmor-1.16.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zizmor
-Version: 1.16.1
+Version: 1.16.2
 License-File: LICENSE
 Summary: Static analysis for GitHub Actions
 Home-Page: https://docs.zizmor.sh
@@ -100,11 +100,6 @@ Shipfox
 <tbody>
 <tr>
 <td align="center" valign="top">
-<a href="http://tenki.cloud/">
-Tenki Cloud
-</a>
-</td>
-<td align="center" valign="top">
 <a href="https://github.com/ariccio">
 Alexander Riccio
 </a>

{zizmor-1.16.1 → zizmor-1.16.2}/crates/github-actions-expressions/Cargo.toml

@@ -2,7 +2,7 @@
 name = "github-actions-expressions"
 description = "GitHub Actions expression parser and data types"
 repository = "https://github.com/zizmorcore/zizmor/tree/main/crates/github-actions-expressions"
-version = "0.0.10"
+version = "0.0.11"
 readme = "README.md"
 
 homepage.workspace = true

{zizmor-1.16.1 → zizmor-1.16.2}/crates/github-actions-expressions/src/call.rs

@@ -67,6 +67,7 @@ impl<'src> Call<'src> {
             let rbrace = template[index..].find('}').map(|pos| index + pos);
 
             // Left brace
+            #[allow(clippy::unwrap_used)]
             if let Some(lbrace_pos) = lbrace
                 && (rbrace.is_none() || rbrace.unwrap() > lbrace_pos)
             {
@@ -105,6 +106,7 @@ impl<'src> Call<'src> {
 
             // Right brace
             if let Some(rbrace_pos) = rbrace {
+                #[allow(clippy::unwrap_used)]
                 if lbrace.is_none() || lbrace.unwrap() > rbrace_pos {
                     // Escaped right brace
                     if template.as_bytes().get(rbrace_pos + 1) == Some(&b'}') {

{zizmor-1.16.1 → zizmor-1.16.2}/crates/github-actions-expressions/src/lib.rs

@@ -321,6 +321,7 @@ impl<'src> Expr<'src> {
     }
 
     /// Parses the given string into an expression.
+    #[allow(clippy::unwrap_used)]
     pub fn parse(expr: &'src str) -> Result<SpannedExpr<'src>> {
         // Top level `expression` is a single `or_expr`.
         let or_expr = ExprParser::parse(Rule::expression, expr)?

{zizmor-1.16.1 → zizmor-1.16.2}/crates/github-actions-models/src/dependabot/v2.rs

@@ -442,11 +442,10 @@ impl<'de> Deserialize<'de> for Schedule {
             ));
         }
 
-        if schedule.interval != Interval::Weekly && schedule.day.is_some() {
-            return Err(custom_error::<D>(
-                "`schedule.day` is only valid when `schedule.interval` is `weekly`",
-            ));
-        }
+        // NOTE(ww): `day` only makes sense with `interval: weekly`, but
+        // Dependabot appears to silently ignore it otherwise. Consequently,
+        // we don't check that for now.
+        // See https://github.com/zizmorcore/zizmor/issues/1305.
 
         Ok(schedule)
     }

zizmor-1.16.2/crates/github-actions-models/tests/sample-dependabot/v2/issue-1305.yml

@@ -0,0 +1,13 @@
+# https://github.com/zizmorcore/zizmor/issues/1305
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+      day: sunday
+    commit-message:
+      prefix: ci
+    labels:
+      - dependencies

{zizmor-1.16.1 → zizmor-1.16.2}/crates/github-actions-models/tests/test_dependabot_v2.rs

@@ -115,15 +115,6 @@ fn test_schedule_cronjob_rejected_for_non_cron() {
     );
 }
 
-#[test]
-fn test_schedule_day_only_for_weekly() {
-    let err = load_dependabot_result("day-on-daily.invalid.yml").unwrap_err();
-    assert!(
-        err.to_string()
-            .contains("`schedule.day` is only valid when `schedule.interval` is `weekly`")
-    );
-}
-
 #[test]
 fn test_schedule_weekly_accepts_day() {
     let dependabot = load_dependabot("weekly-with-day.yml");

{zizmor-1.16.1 → zizmor-1.16.2}/crates/subfeature/Cargo.toml

@@ -2,7 +2,7 @@
 name = "subfeature"
 description = "Subfeature handling and manipulation APIs"
 repository = "https://github.com/zizmorcore/zizmor/tree/main/crates/subfeature"
-version = "0.0.3"
+version = "0.0.4"
 readme = "README.md"
 
 authors.workspace = true

{zizmor-1.16.1 → zizmor-1.16.2}/crates/subfeature/src/lib.rs

@@ -68,11 +68,15 @@ impl<'a> Fragment<'a> {
             // string literals.
             let escaped = regex::escape(fragment);
 
+            #[allow(clippy::unwrap_used)]
             static WHITESPACE: LazyLock<regex::Regex> =
                 LazyLock::new(|| regex::Regex::new(r"\s+").unwrap());
             let regex = WHITESPACE.replace_all(&escaped, "\\s+");
 
-            Fragment::Regex(regex::bytes::Regex::new(&regex).unwrap())
+            Fragment::Regex(
+                regex::bytes::Regex::new(&regex)
+                    .expect("internal error: failed to compile fragment regex"),
+            )
         }
     }
 }

{zizmor-1.16.1 → zizmor-1.16.2}/crates/yamlpatch/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "yamlpatch"
-version = "0.4.0"
+version = "0.5.0"
 description = "Comment and format-preserving YAML patch operations"
 repository = "https://github.com/zizmorcore/zizmor/tree/main/crates/yamlpatch"
 keywords = ["yaml", "patch"]

{zizmor-1.16.1 → zizmor-1.16.2}/crates/yamlpatch/src/lib.rs

@@ -582,7 +582,10 @@ pub fn serialize_flow(value: &serde_yaml::Value) -> Result<String, Error> {
 fn line_span(doc: &yamlpath::Document, pos: usize) -> core::ops::Range<usize> {
     let pos = TextSize::new(pos as u32);
     let LineCol { line, .. } = doc.line_index().line_col(pos);
-    doc.line_index().line(line).unwrap().into()
+    doc.line_index()
+        .line(line)
+        .expect("impossible: line index gave us an invalid line")
+        .into()
 }
 
 /// Extract the number of leading spaces need to align a block item with
@@ -895,7 +898,7 @@ fn apply_value_replacement(
                         .join("\n");
 
                     // Find the position of | in the original content and include it
-                    let pipe_pos = value_part.find('|').unwrap();
+                    let pipe_pos = value_part.find('|').expect("impossible");
                     let key_with_pipe = &current_content_with_ws
                         [..colon_pos + 1 + value_part[..pipe_pos].len() + 1];
                     return Ok(format!(

{zizmor-1.16.1 → zizmor-1.16.2}/crates/yamlpath/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "yamlpath"
-version = "0.27.0"
+version = "0.28.0"
 description = "Format-preserving YAML feature extraction"
 repository = "https://github.com/zizmorcore/zizmor/tree/main/crates/yamlpath"
 readme = "README.md"

{zizmor-1.16.1 → zizmor-1.16.2}/crates/yamlpath/src/lib.rs

@@ -232,7 +232,10 @@ impl Feature<'_> {
         // `block_node` or `flow_node`, which is a container
         // for the real kind of node we're interested in.
         let node = match self._node.kind() {
-            "block_node" | "flow_node" => self._node.child(0).unwrap(),
+            "block_node" | "flow_node" => self
+                ._node
+                .child(0)
+                .expect("internal error: expected child of block_node/flow_node"),
             _ => self._node,
         };
 
@@ -317,7 +320,9 @@ impl Tree {
             for anchor in TreeIter::new(tree).filter(|n| n.kind() == "anchor") {
                 // NOTE(ww): We could poke into the `anchor_name` child
                 // instead of slicing, but this is simpler.
-                let anchor_name = &anchor.utf8_text(tree.source.as_bytes()).unwrap()[1..];
+                let anchor_name = &anchor
+                    .utf8_text(tree.source.as_bytes())
+                    .expect("impossible: anchor name should be UTF-8 by construction")[1..];
 
                 // Only insert if the anchor name is unique.
                 if anchor_map.contains_key(anchor_name) {
@@ -356,7 +361,8 @@ impl Clone for Tree {
         // it borrows from the tree.
         // TODO: Can we do better here?
         // Unwrap safety: we're cloning from an existing valid owner.
-        Self::build(self.borrow_owner().clone()).unwrap()
+        Self::build(self.borrow_owner().clone())
+            .expect("impossible: cloning a Tree preserves invariants")
     }
 }
 
@@ -403,7 +409,9 @@ impl Document {
         parser.set_language(&language)?;
 
         // NOTE: Infallible, assuming `language` is correctly constructed above.
-        let tree = parser.parse(&source, None).unwrap();
+        let tree = parser
+            .parse(&source, None)
+            .expect("impossible: tree-sitter parsing should never fail");
 
         if tree.root_node().has_error() {
             return Err(QueryError::InvalidInput);
@@ -691,7 +699,9 @@ impl Document {
         // TODO(ww): What about nested aliases?
         focus_node = match focus_node.child(0) {
             Some(child) if child.kind_id() == self.alias_id => {
-                let alias_name = child.utf8_text(self.source().as_bytes()).unwrap();
+                let alias_name = child
+                    .utf8_text(self.source().as_bytes())
+                    .expect("impossible: alias name should be UTF-8 by construction");
                 let anchor_map = self.tree.borrow_dependent();
                 *anchor_map
                     .get(&alias_name[1..])
@@ -713,7 +723,7 @@ impl Document {
                     && focus_node.kind_id() != self.block_mapping_pair_id
                     && focus_node.kind_id() != self.flow_pair_id
                 {
-                    focus_node.parent().unwrap()
+                    focus_node.parent().expect("missing parent of focus node")
                 } else {
                     focus_node
                 }
@@ -733,11 +743,15 @@ impl Document {
                     // We might be on the internal `block_scalar` node, if
                     // we got here via an alias. We need to go up two levels
                     // to get to the mapping pair.
-                    focus_node.parent().unwrap().parent().unwrap()
+                    focus_node
+                        .parent()
+                        .expect("missing parent of focus node")
+                        .parent()
+                        .expect("missing grandparent of focus node")
                 } else {
                     // Otherwise, we expect to be on the `block_node`
                     // or `flow_node`, so we go up one level.
-                    focus_node.parent().unwrap()
+                    focus_node.parent().expect("missing parent of focus node")
                 };
 
                 if parent_node.kind_id() == self.flow_mapping_id {
@@ -773,7 +787,7 @@ impl Document {
             && matches!(route.route.last(), Some(Component::Key(_)))
             && focus_node.kind_id() != self.block_mapping_pair_id
         {
-            focus_node = focus_node.parent().unwrap()
+            focus_node = focus_node.parent().expect("missing parent of focus node")
         }
 
         Ok(focus_node)
@@ -821,7 +835,9 @@ impl Document {
         // We might be on an alias node, in which case we need to
         // jump to the alias's target via the anchor map.
         if child.kind_id() == self.alias_id {
-            let alias_name = node.utf8_text(self.source().as_bytes()).unwrap();
+            let alias_name = node
+                .utf8_text(self.source().as_bytes())
+                .expect("impossible: alias name should be UTF-8 by construction");
             let anchor_map = self.tree.borrow_dependent();
 
             child = *anchor_map
@@ -872,7 +888,9 @@ impl Document {
             // NOTE: text unwraps are infallible, since our document is UTF-8.
             let key_value = match key.named_child(0) {
                 Some(scalar) => {
-                    let key_value = scalar.utf8_text(self.source().as_bytes()).unwrap();
+                    let key_value = scalar
+                        .utf8_text(self.source().as_bytes())
+                        .expect("impossible: value for key should be UTF-8 by construction");
 
                     match scalar.kind() {
                         "single_quote_scalar" | "double_quote_scalar" => {
@@ -884,7 +902,9 @@ impl Document {
                         _ => key_value,
                     }
                 }
-                None => key.utf8_text(self.source().as_bytes()).unwrap(),
+                None => key
+                    .utf8_text(self.source().as_bytes())
+                    .expect("impossible: key should be UTF-8 by construction"),
             };
 
             if key_value == expected {
@@ -939,8 +959,10 @@ impl Document {
             // From here, we need to peek inside each and see if it's
             // an alias. If it is, we expand the alias; otherwise, we
             // just keep the child as-is.
-            if child.named_child(0).unwrap().kind() == "alias" {
-                let alias_name = &child.utf8_text(self.source().as_bytes()).unwrap()[1..];
+            if child.named_child(0).map(|c| c.kind()) == Some("alias") {
+                let alias_name = &child
+                    .utf8_text(self.source().as_bytes())
+                    .expect("impossible: alias name should be UTF-8 by construction")[1..];
                 let anchor_map = self.tree.borrow_dependent();
                 let aliased_node = anchor_map
                     .get(alias_name)

{zizmor-1.16.1 → zizmor-1.16.2}/crates/zizmor/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "zizmor"
 description = "Static analysis for GitHub Actions"
-version = "1.16.1"
+version = "1.16.2"
 repository = "https://github.com/zizmorcore/zizmor"
 documentation = "https://docs.zizmor.sh"
 keywords = ["cli", "github-actions", "static-analysis", "security"]

{zizmor-1.16.1 → zizmor-1.16.2}/crates/zizmor/README.md

@@ -87,11 +87,6 @@ Shipfox
 <tbody>
 <tr>
 <td align="center" valign="top">
-<a href="http://tenki.cloud/">
-Tenki Cloud
-</a>
-</td>
-<td align="center" valign="top">
 <a href="https://github.com/ariccio">
 Alexander Riccio
 </a>

{zizmor-1.16.1 → zizmor-1.16.2}/crates/zizmor/build.rs

@@ -1,3 +1,5 @@
+#![allow(clippy::unwrap_used)]
+
 use std::fs::{self, File};
 use std::path::Path;
 use std::{env, io};

{zizmor-1.16.1 → zizmor-1.16.2}/crates/zizmor/src/audit/artipacked.rs

@@ -208,7 +208,7 @@ mod tests {
     /// 4. Executes the provided test closure with the findings
     macro_rules! test_workflow_audit {
         ($audit_type:ty, $filename:expr, $workflow_content:expr, $test_fn:expr) => {{
-            let key = InputKey::local("fakegroup".into(), $filename, None::<&str>).unwrap();
+            let key = InputKey::local("fakegroup".into(), $filename, None::<&str>);
             let workflow = Workflow::from_string($workflow_content.to_string(), key).unwrap();
             let audit_state = AuditState::default();
             let audit = <$audit_type>::new(&audit_state).unwrap();

{zizmor-1.16.1 → zizmor-1.16.2}/crates/zizmor/src/audit/bot_conditions.rs

@@ -24,6 +24,7 @@ pub(crate) struct BotConditions;
 
 audit_meta!(BotConditions, "bot-conditions", "spoofable bot actor check");
 
+#[allow(clippy::unwrap_used)]
 static SPOOFABLE_ACTOR_NAME_CONTEXTS: LazyLock<Vec<ContextPattern>> = LazyLock::new(|| {
     vec![
         ContextPattern::try_new("github.actor").unwrap(),
@@ -32,6 +33,7 @@ static SPOOFABLE_ACTOR_NAME_CONTEXTS: LazyLock<Vec<ContextPattern>> = LazyLock::
     ]
 });
 
+#[allow(clippy::unwrap_used)]
 static SPOOFABLE_ACTOR_ID_CONTEXTS: LazyLock<Vec<ContextPattern>> = LazyLock::new(|| {
     vec![
         ContextPattern::try_new("github.actor_id").unwrap(),
@@ -417,7 +419,7 @@ mod tests {
     /// Macro for testing workflow audits with common boilerplate
     macro_rules! test_workflow_audit {
         ($audit_type:ty, $filename:expr, $workflow_content:expr, $test_fn:expr) => {{
-            let key = InputKey::local("fakegroup".into(), $filename, None::<&str>).unwrap();
+            let key = InputKey::local("fakegroup".into(), $filename, None::<&str>);
             let workflow = Workflow::from_string($workflow_content.to_string(), key).unwrap();
             let audit_state = AuditState::default();
             let audit = <$audit_type>::new(&audit_state).unwrap();

{zizmor-1.16.1 → zizmor-1.16.2}/crates/zizmor/src/audit/cache_poisoning.rs

@@ -20,6 +20,7 @@ use super::AuditLoadError;
 /// The list of know cache-aware actions
 /// In the future we can easily retrieve this list from the static API,
 /// since it should be easily serializable
+#[allow(clippy::unwrap_used)]
 static KNOWN_CACHE_AWARE_ACTIONS: LazyLock<Vec<ActionCoordinate>> = LazyLock::new(|| {
     vec![
         // https://github.com/actions/cache/blob/main/action.yml
@@ -203,6 +204,7 @@ static KNOWN_CACHE_AWARE_ACTIONS: LazyLock<Vec<ActionCoordinate>> = LazyLock::ne
 
 /// A list of well-know publisher actions
 /// In the future we can retrieve this list from the static API
+#[allow(clippy::unwrap_used)]
 static KNOWN_PUBLISHER_ACTIONS: LazyLock<Vec<ActionCoordinate>> = LazyLock::new(|| {
     vec![
         // Public packages and/or binary distribution channels
@@ -495,7 +497,7 @@ mod tests {
     /// 4. Executes the provided test closure with the findings
     macro_rules! test_workflow_audit {
         ($audit_type:ty, $filename:expr, $workflow_content:expr, $test_fn:expr) => {{
-            let key = InputKey::local("fakegroup".into(), $filename, None::<&str>).unwrap();
+            let key = InputKey::local("fakegroup".into(), $filename, None::<&str>);
             let workflow = Workflow::from_string($workflow_content.to_string(), key).unwrap();
             let audit_state = AuditState::default();
             let audit = <$audit_type>::new(&audit_state).unwrap();

{zizmor-1.16.1 → zizmor-1.16.2}/crates/zizmor/src/audit/concurrency_limits.rs

@@ -6,7 +6,7 @@ use crate::{
     state::AuditState,
 };
 use anyhow::Result;
-use github_actions_models::{common::expr::BoE, workflow::Concurrency};
+use github_actions_models::workflow::Concurrency;
 
 pub(crate) struct ConcurrencyLimits;
 
@@ -28,29 +28,6 @@ impl Audit for ConcurrencyLimits {
     ) -> Result<Vec<Finding<'doc>>> {
         let mut findings = vec![];
         match &workflow.concurrency {
-            Some(Concurrency::Rich {
-                group: _,
-                cancel_in_progress,
-            }) => {
-                if let BoE::Literal(cancel) = &cancel_in_progress
-                    && !cancel
-                {
-                    findings.push(
-                        Self::finding()
-                            .confidence(Confidence::High)
-                            .severity(Severity::Low)
-                            .persona(Persona::Pedantic)
-                            .add_location(
-                                workflow
-                                    .location()
-                                    .primary()
-                                    .with_keys(["concurrency".into()])
-                                    .annotated("cancel-in-progress set to false"),
-                            )
-                            .build(workflow)?,
-                    );
-                };
-            }
             Some(Concurrency::Bare(_)) => {
                 findings.push(
                     Self::finding()
@@ -82,6 +59,11 @@ impl Audit for ConcurrencyLimits {
                         .build(workflow)?,
                 );
             }
+            // NOTE: Per #1302, we don't nag the user if they've explicitly set
+            // `cancel-in-progress: false` or similar. This is like with the
+            // artipacked audit, where `persist-credentials: true` is seen as
+            // a positive signal of user intent.
+            _ => {}
         }
 
         Ok(findings)

{zizmor-1.16.1 → zizmor-1.16.2}/crates/zizmor/src/audit/dependabot_cooldown.rs

@@ -164,7 +164,7 @@ mod tests {
     /// Macro for testing dependabot audits with common boilerplate
     macro_rules! test_dependabot_audit {
         ($audit_type:ty, $filename:expr, $dependabot_content:expr, $test_fn:expr) => {{
-            let key = InputKey::local("fakegroup".into(), $filename, None::<&str>).unwrap();
+            let key = InputKey::local("fakegroup".into(), $filename, None::<&str>);
             let dependabot = Dependabot::from_string($dependabot_content.to_string(), key).unwrap();
             let audit_state = AuditState::default();
             let audit = <$audit_type>::new(&audit_state).unwrap();

{zizmor-1.16.1 → zizmor-1.16.2}/crates/zizmor/src/audit/dependabot_execution.rs

@@ -84,7 +84,7 @@ mod tests {
     /// Macro for testing dependabot audits with common boilerplate
     macro_rules! test_dependabot_audit {
         ($audit_type:ty, $filename:expr, $dependabot_content:expr, $test_fn:expr) => {{
-            let key = InputKey::local("fakegroup".into(), $filename, None::<&str>).unwrap();
+            let key = InputKey::local("fakegroup".into(), $filename, None::<&str>);
             let dependabot = Dependabot::from_string($dependabot_content.to_string(), key).unwrap();
             let audit_state = AuditState::default();
             let audit = <$audit_type>::new(&audit_state).unwrap();