ci: ignore zizmor dangerous triggers for PR writers
What the developer wrote
Authored by Jose Storopoli
ci: ignore zizmor dangerous triggers for PR writers
What changed, and why it matters
This commit only adds code-quality comments to two GitHub workflow files so that the zizmor security linter stops flagging the use of 'pull_request_target' and 'workflow_run' triggers. It does not change any workflow logic, permissions, or behavior, and therefore has no direct security impact on the project itself.
No action required beyond normal review. Ensure the pre-existing use of pull_request_target and workflow_run is justified and that these workflows do not checkout or execute untrusted PR code with elevated permissions. Consider documenting the security rationale for the suppressions in the commit or workflow comments.
Security signals we found
zizmor dangerous-triggers suppression comment added
pull_request_target trigger present (pre-existing)
workflow_run trigger present (pre-existing)
Evidence from the diff
The diff adds ‘# zizmor: ignore[dangerous-triggers]’ inline suppression comments to the YAML definitions of two existing workflow triggers: pull_request_target in manage-pr.yml and workflow_run in semver-checks-pr-label.yml. No other lines are modified. These triggers remain inherently risky in GitHub Actions, but the commit does not alter their configuration, permissions (already set to permissions: {} in manage-pr.yml), or the code they execute. It is purely a linting/CI-hygiene change.
Changed components
.github/workflows/manage-pr.yml.github/workflows/semver-checks-pr-label.ymlInspect captured patch +2 / −2
diff --git a/.github/workflows/manage-pr.yml b/.github/workflows/manage-pr.yml
index 4f8ae325..b22bd354 100644
--- a/.github/workflows/manage-pr.yml
+++ b/.github/workflows/manage-pr.yml
@@ -1,6 +1,6 @@
name: Manage PR
on:
- - pull_request_target
+ - pull_request_target # zizmor: ignore[dangerous-triggers]
permissions: {}
jobs:
diff --git a/.github/workflows/semver-checks-pr-label.yml b/.github/workflows/semver-checks-pr-label.yml
index a1538bf5..f525ec6d 100644
--- a/.github/workflows/semver-checks-pr-label.yml
+++ b/.github/workflows/semver-checks-pr-label.yml
@@ -1,5 +1,5 @@
on: # yamllint disable-line rule:truthy
- workflow_run:
+ workflow_run: # zizmor: ignore[dangerous-triggers]
workflows: [Check semver breaks]
types: [completed]
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.