Skip to content

Add zizmor to pre-commit#1382

Merged
fizyk merged 1 commit into
mainfrom
zizmor
Jul 24, 2026
Merged

Add zizmor to pre-commit#1382
fizyk merged 1 commit into
mainfrom
zizmor

Conversation

@fizyk

@fizyk fizyk commented Jul 24, 2026

Copy link
Copy Markdown
Member

Summary by CodeRabbit

  • Security
    • Hardened GitHub Actions default token permissions to an empty baseline, with jobs granting only the minimum required access.
    • Documented and safeguarded PostgreSQL setup workflow usage where unpinned references are intentionally tolerated.
  • Automation
    • Made the build workflow callable as a reusable workflow for other pipelines.
    • Updated publishing-related automation to rely on the repository’s standard build workflow.
  • Quality
    • Improved Windows PostgreSQL control detection used in CI runs.
    • Added Zizmor to pre-commit checks for automated workflow security validation.
  • Documentation
    • Added a release/news fragment describing the workflow permission hardening and validation updates.

@coderabbitai

coderabbitai Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: b125177a-84b8-47af-9194-662f9f478125

📥 Commits

Reviewing files that changed from the base of the PR and between 93db190 and 4011ca6.

📒 Files selected for processing (13)
  • .github/actions/detect-pg-ctl/action.yml
  • .github/workflows/async-postgres.yml
  • .github/workflows/automerge.yml
  • .github/workflows/build.yml
  • .github/workflows/oldest-postgres.yml
  • .github/workflows/pr-check.yml
  • .github/workflows/pre-commit.yml
  • .github/workflows/pypi.yml
  • .github/workflows/release.yml
  • .github/workflows/single-postgres-windows.yml
  • .github/workflows/single-postgres.yml
  • .pre-commit-config.yaml
  • newsfragments/+zizmor.misc.rst
🚧 Files skipped from review as they are similar to previous changes (11)
  • .pre-commit-config.yaml
  • .github/workflows/automerge.yml
  • .github/workflows/build.yml
  • .github/workflows/pr-check.yml
  • .github/workflows/pre-commit.yml
  • .github/workflows/single-postgres.yml
  • .github/workflows/single-postgres-windows.yml
  • .github/workflows/async-postgres.yml
  • .github/workflows/release.yml
  • .github/workflows/pypi.yml
  • .github/workflows/oldest-postgres.yml

📝 Walkthrough

Walkthrough

Zizmor is added to pre-commit and workflow audit exceptions document intentionally unpinned actions. GitHub Actions workflows receive explicit permission baselines, selected jobs receive contents: read, PyPI uses a local reusable build workflow, and Windows PostgreSQL path resolution uses a step environment variable.

Changes

Zizmor and workflow hardening

Layer / File(s) Summary
Zizmor registration and audit annotations
.pre-commit-config.yaml, .github/workflows/*postgres*.yml, .github/workflows/automerge.yml
Adds the Zizmor pre-commit hook and documents or suppresses checks for intentional action references and the automerge trigger.
Reusable build workflow wiring
.github/workflows/build.yml, .github/workflows/pypi.yml
Makes the build workflow reusable and changes PyPI packaging to invoke the local workflow with contents: read.
Workflow permission baselines
.github/workflows/automerge.yml, .github/workflows/pr-check.yml, .github/workflows/pre-commit.yml, .github/workflows/pypi.yml, .github/workflows/release.yml, newsfragments/*
Adds explicit empty top-level permissions and records the workflow hardening in a news fragment.
Windows PostgreSQL path resolution
.github/actions/detect-pg-ctl/action.yml
Sets POSTGRESQL_VERSION in the step environment and uses it to construct the Windows pg_ctl.exe path.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 6
✅ Passed checks (6 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title matches the main change: adding Zizmor to the pre-commit setup, which is a central part of the pull request.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Newsfragment Check ✅ Passed A newsfragment was added at newsfragments/+zizmor.misc.rst, and pyproject.toml allows the misc Towncrier type.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch zizmor

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@codecov

codecov Bot commented Jul 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/async-postgres.yml:
- Around line 40-43: Replace the mutable ankane/setup-postgres@v1 reference with
a reviewed full commit SHA in .github/workflows/async-postgres.yml:40-43,
.github/workflows/oldest-postgres.yml:46-49,
.github/workflows/single-postgres-windows.yml:40-43, and
.github/workflows/single-postgres.yml:45-48; apply the same current v1 commit
pin at each workflow usage and remove the obsolete zizmor unpinned-use
suppression.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bf1512a7-9aa8-4f09-ab3b-03bc830b9019

📥 Commits

Reviewing files that changed from the base of the PR and between 2015557 and 93db190.

📒 Files selected for processing (12)
  • .github/workflows/async-postgres.yml
  • .github/workflows/automerge.yml
  • .github/workflows/build.yml
  • .github/workflows/oldest-postgres.yml
  • .github/workflows/pr-check.yml
  • .github/workflows/pre-commit.yml
  • .github/workflows/pypi.yml
  • .github/workflows/release.yml
  • .github/workflows/single-postgres-windows.yml
  • .github/workflows/single-postgres.yml
  • .pre-commit-config.yaml
  • newsfragments/+zizmor.misc.rst

Comment thread .github/workflows/async-postgres.yml
@fizyk
fizyk merged commit 48e7e6e into main Jul 24, 2026
57 checks passed
@fizyk
fizyk deleted the zizmor branch July 24, 2026 13:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant