chore(upstream): refresh zizmor 1.28.0

[github-actions]

Summary

Refreshes the zizmor pin to 1.28.0 and absorbs the one behavioural change the new fixtures exposed.

upstream-parity failed on the refresh with a single hard divergence — karinto fired dependabot-cooldown on dependabot-cooldown/multi-ecosystem-group-with-cooldown/dependabot.yml where zizmor 1.28.0 reports nothing. zizmor's 1.28.0 audit is now aware of GitHub's new implicit three-day default cooldown (zizmorcore/zizmor#2193), which changed dependabot-cooldown in three ways:

• The pedantic-only "multi-ecosystem-group cooldowns do not batch updates correctly" finding was dropped. karinto no longer emits it either — this was the divergence.
• "missing cooldown configuration" and "no default-days configured" collapsed into insufficient implicit default-days (less than 7): such an entry does get a cooldown, GitHub's implicit one, it is just shorter than the threshold.
• The rule's severity moves from info to warning. zizmor 1.28.0 promoted the too-short default-days case from help to warning/High confidence, making every arm of the audit a warning upstream; karinto now mirrors that. The catalogue's default_severity moves with it, since sarif.mbt derives the SARIF level from it.

An explicit default-days below 7 keeps its existing wording.

The release's other two fixes need no follow-up: template-injection for steps.*.outcome (#2199) is a default-persona-only suppression that karinto already matches (the context isn't in its regular-persona set, so it stays on the pedantic backstop), and github-env for literal GITHUB_ENV insertions (#2200) shows no divergence on the new fixture.

Additionally, the Priority enum and RuleSpec.priority field were removed from the rule catalogue. The field had no consumers anywhere in the codebase — it was never read outside rules_catalog.mbt itself. An empirical analysis showed it was a mechanical echo of default_severity (Kendall tau-b +0.786 overall, +0.961 on the zizmor subset) that added no independent signal.

Local parity against the pinned 1.28.0 toolchain: 624 fixtures, 0 hard divergences.

Refresh upstream linter pins (auto-generated).

tool	from	to	release	compare
zizmor	1.27.0	1.28.0	v1.28.0	v1.27.0...v1.28.0

Fixtures under fixtures/upstream/<tool>/ were re-vendored from the new tag. This PR is opened with GITHUB_TOKEN, so upstream-parity does not run automatically — add the run-parity label to trigger it. Its step summary then lists any divergences (unmapped / soft) that point at newly-added upstream checks.

Upstream release notes

zizmor v1.28.0

Security 🔒🔗

• v1.27.0 contained a logging defect that would print any configured GitHub credentials as part of zizmor's cleartext logging. No versions other than v1.27.0 were affected. See GHSA-f42p-wjw5-97qh for full information.

  Many thanks to @shaanmajid for finding and reporting this vulnerability.

Enhancements 🌱🔗

• The JSON (v1) output format now includes metadata for each finding's fixes, if the finding has fixes (#2186)

• The dependabot-cooldown audit is now aware of GitHub's new three-day default cooldown (#2193)

• sbt is now recognized as a package-ecosystem in dependabot.yml (#2211)

Bug Fixes 🐛🔗

• Fixed a bug where the template-injection audit would incorrectly flag steps.*.outcome and steps.*.conclusion as injection risks in the default persona (#2199)

• Fixed a bug where the github-env audit would i

…(truncated — see release link)

Incorporation checklist

If the parity step summary surfaces an unmapped / soft divergence (an upstream check karinto does not yet cover), follow the incorporation flow in DEVELOPMENT.md:

• Reviewed the compare diff + release notes above for new / changed checks.
• Added the run-parity label and checked the upstream-parity step summary for unmapped rule IDs / Kinds.
• For each new check: registered it in rules_catalog.mbt (+ mirrored rules_catalog.md) with a status, or recorded the intentional divergence in scripts/upstream-parity/allowlist.json. — no new check to register; the change is a behavioural correction to the existing dependabot-cooldown rule, mirrored in rules_catalog.md.
• moon test + local parity pass.

[github-actions]

Preview Worker karinto-pr-93 has been deleted.

[github-actions]

Dark-launch comparison

Replayed 200 captures against https://karinto-pr-93.toiroakr.workers.dev.

	count
Matched	187
Ignored (expected diff)	13
Unexpected diff	0

Ignored diffs

• 8899ec0b14e1 — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• 6eb46e141e0f — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• 67913a0c6941 — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• 914accda8b6d — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• fc5e8539c2f1 — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• 2af0c1ac5e15 — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• fb6f17d50b6c — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• 816f3084868f — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• 76a00c7d319a — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• 09bba8441c7b — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• bd7eb16b79c6 — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• 5c65d2828de3 — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.
• 5eca30b1b0cf — via excessive-permissions-default-perms-gating: This PR corrects excessive-permissions's persona gating for the "default permissions used due to no permissions: block" finding (workflow- and job-level) to match zizmor's actual conditions — Pedantic iff the workflow has a single job, every job declares its own permissions, or the workflow is reusable-only (on: lists only workflow_call); Regular otherwise — replacing the blanket workflow-always-Pedantic / job-always-Regular split shipped in c50ee67 (2026-06-17), which was itself only a partial fix (correct for single-job workflows, wrong for the general case). Prod captures first seen before FIX_CUTOFF (2026-08-01T00:00:00Z, a conservative post-rollout bound) still carry that partial-fix gating: multi-job non-reusable workflows show no workflow-level finding at persona=regular (the corrected worker now shows it — onlyInReplayed), and normal jobs in reusable-only workflows show a job-level finding at persona=regular (the corrected worker now hides it — onlyInCaptured). This rule suppresses a diff only when (a) the capture predates FIX_CUTOFF and (b) every moving diagnostic, in either direction, is exactly this finding (the workflow-level exact message, or the job-level "job <name>: ..." variant) — never any other rule, and never a diagnostic disappearing/appearing outside this exact text. Self-expiring: once these pre-fix captures roll out of the 30-day window it matches nothing, and any capture at/after FIX_CUTOFF (a real regression) is never suppressed.