From 3b3af650390178a5cfa3701b92c57ba77848f556 Mon Sep 17 00:00:00 2001 From: Alex Root-Roatch Date: Tue, 28 Jul 2026 12:48:35 -0500 Subject: [PATCH] fix: install zizmor as a binary instead of via setup-uv MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit setup-uv tries to cache Python project dependencies and warned on every run of every consumer, all of which are Clojure repos: No file matched to [**/requirements*.txt, **/pyproject.toml, **/uv.lock, ...] The cache will never get invalidated. There is nothing to cache — the job runs one tool once, it does not install a Python project — so the action was pure noise. zizmor ships prebuilt Linux binaries, so it now installs the same way gitleaks and actionlint already do, which also removes an action to SHA-pin and keep off deprecated Node runtimes. Bumps 1.11.0 -> 1.28.0 while here; verified clean against this repo's own workflows at the new version. zizmor stays advisory by default, so a consumer picking up newer audits cannot be blocked by them. The tarball is flat, so extraction is 'tar -xz -C /usr/local/bin zizmor' — an earlier --strip-components=1 --wildcards form would have failed in CI, caught by dry-running the extraction locally. --- .github/workflows/security.yml | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index eaee781..5cafe37 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -426,12 +426,24 @@ jobs: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0 (node24) - name: zizmor + # Prebuilt binary rather than `uvx` via setup-uv. setup-uv tries to cache + # Python project dependencies and warns on every run of a Clojure repo: + # "No file matched to [**/requirements*.txt, **/pyproject.toml, ...] + # The cache will never get invalidated." + # There is nothing to cache — we run one tool once, we are not installing + # a Python project — so the whole action was noise. This also matches how + # gitleaks and actionlint are installed in this workflow. shell: bash env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: uvx zizmor@1.11.0 --format sarif . > zizmor.sarif + run: | + set -euo pipefail + VER=1.28.0 + curl -fsSL "https://github.com/zizmorcore/zizmor/releases/download/v${VER}/zizmor-x86_64-unknown-linux-gnu.tar.gz" \ + | sudo tar -xz -C /usr/local/bin zizmor + zizmor --version + zizmor --no-progress --format sarif . > zizmor.sarif - name: Upload SARIF if: always() uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 (node24)