[PD1-138] Fix zizmor findings - #5
Merged
Merged
Conversation
Clear the zizmor findings in the action, so that the shared GitHub Actions static-analysis workflow can be rolled out to this repository. The package manager input, the run prefix the detection step selects, and the source directories now reach the shell through the environment instead of being expanded into the script, where a value containing shell syntax would have been executed. The run prefix and the source directory list are still left unquoted, since both are meant to split into separate words, and a comment above the lint steps says so. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
pgogadcv
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Clears this action's
zizmorfindings — 9 of them, 5 high — so the shared GitHub Actions static-analysis workflow can be rolled out here (CVector-Energy/cvec-management-account#197 extends that workflow's path filters to cover action definitions, which is what will start analyzing this repo).All 9 are
template-injection:${{ inputs.package-manager }},${{ inputs.src-dirs }}, and${{ steps.pm.outputs.run }}were expanded directly intorunblocks, so a value containing shell syntax would have been executed with the job's permissions. They now arrive throughenv:.One deliberate detail:
$RUN(theuv run/poetry runprefix) and$SRC_DIRS(a space-separated list) are left unquoted, because both are meant to split into separate words — quoting them would passuv runas a single command name and the directory list as one argument. There is a comment above the lint steps recording that. I confirmed the splitting in a local shell:$RUN ruff format $SRC_DIRSexpands to 6 arguments, as before.Verified with zizmor 1.25.2: clean. No interface change — same inputs, same behaviour.