zizmor 1.5.0__tar.gz → 1.5.1__tar.gz

{zizmor-1.5.0 → zizmor-1.5.1}/Cargo.lock

@@ -3132,7 +3132,7 @@ dependencies = [
 
 [[package]]
 name = "zizmor"
-version = "1.5.0"
+version = "1.5.1"
 dependencies = [
  "annotate-snippets",
  "anstream",

{zizmor-1.5.0 → zizmor-1.5.1}/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "zizmor"
 description = "Static analysis for GitHub Actions"
-version = "1.5.0"
+version = "1.5.1"
 edition = "2024"
 repository = "https://github.com/woodruffw/zizmor"
 homepage = "https://github.com/woodruffw/zizmor"

{zizmor-1.5.0 → zizmor-1.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: zizmor
-Version: 1.5.0
+Version: 1.5.1
 License-File: LICENSE
 Summary: Static analysis for GitHub Actions
 Keywords: cli,github-actions,static-analysis,security

{zizmor-1.5.0 → zizmor-1.5.1}/docs/release-notes.md

@@ -9,6 +9,13 @@ of `zizmor`.
 
 ## Next (UNRELEASED)
 
+## v1.5.1
+
+### Bug Fixes 🐛
+
+* Fixed a bug where `zizmor` would fail to honor `.gitignore` files
+  when a `.git/` directory is not present (#598)
+
 ## v1.5.0
 
 ### New Features 🌈
@@ -465,7 +472,7 @@ This is one of `zizmor`'s bigger recent releases! Key enhancements include:
 ### Bug Fixes 🐛
 * Fix typos including `github.repostoryUrl` -> `github.repositoryUrl` by @hugovk in #164
 
-## v0.3,2
+## v0.3.2
 
 **Full Changelog**: https://github.com/woodruffw/zizmor/compare/v0.3.1...v0.3.2
 

{zizmor-1.5.0 → zizmor-1.5.1}/docs/usage.md

@@ -472,7 +472,7 @@ To do so, add the following to your `.pre-commit-config.yaml` `repos` section:
 
 ```yaml
 - repo: https://github.com/woodruffw/zizmor-pre-commit
-  rev: v1.5.0 # (1)!
+  rev: v1.5.1 # (1)!
   hooks:
   - id: zizmor
 ```

{zizmor-1.5.0 → zizmor-1.5.1}/src/main.rs

@@ -245,8 +245,19 @@ fn collect_from_dir(
     // explicitly enable it. This also enables filtering by a global
     // `.gitignore` file and the `.git/info/exclude` file, since these
     // typically align with the user's expectations.
+    //
+    // We honor `.gitignore` and similar files even if `.git/` is not
+    // present, since users may retrieve or reconstruct a source archive
+    // without a `.git/` directory. In particular, this snares some
+    // zizmor integrators.
+    //
+    // See: https://github.com/woodruffw/zizmor/issues/596
     if mode.respects_gitignore() {
-        walker.git_ignore(true).git_global(true).git_exclude(true);
+        walker
+            .require_git(false)
+            .git_ignore(true)
+            .git_global(true)
+            .git_exclude(true);
     }
 
     for entry in walker.build() {