fix: install zizmor as a binary instead of via setup-uv - #7
Merged
Conversation
setup-uv tries to cache Python project dependencies and warned on every run of every consumer, all of which are Clojure repos: No file matched to [**/requirements*.txt, **/pyproject.toml, **/uv.lock, ...] The cache will never get invalidated. There is nothing to cache — the job runs one tool once, it does not install a Python project — so the action was pure noise. zizmor ships prebuilt Linux binaries, so it now installs the same way gitleaks and actionlint already do, which also removes an action to SHA-pin and keep off deprecated Node runtimes. Bumps 1.11.0 -> 1.28.0 while here; verified clean against this repo's own workflows at the new version. zizmor stays advisory by default, so a consumer picking up newer audits cannot be blocked by them. The tarball is flat, so extraction is 'tar -xz -C /usr/local/bin zizmor' — an earlier --strip-components=1 --wildcards form would have failed in CI, caught by dry-running the extraction locally.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
astral-sh/setup-uvtries to cache Python project dependencies, and warned onevery run of every consumer — all of which are Clojure repos:
There is nothing to cache. The job runs one tool once; it does not install a
Python project. So the action was pure noise on a path that every consumer hits.
zizmor ships prebuilt Linux binaries, so it now installs the same way
gitleaksand
actionlintalready do in this workflow. That also removes an action toSHA-pin and to keep off deprecated Node runtimes.
Bumps
1.11.0→1.28.0while here, verified clean against this repo's ownworkflows at the new version. zizmor remains advisory by default, so a consumer
picking up newer audits cannot be blocked by them.
One thing caught locally rather than in CI: the release tarball is flat (just
zizmor, no top-level directory), so an initial--strip-components=1 --wildcards '*/zizmor'form would have failed. Dry-runningthe extraction found it before pushing.
🤖 Generated with Claude Code