chore(upstream): refresh zizmor 1.28.0

.changeset/dependabot-cooldown-zizmor-1-28.md

@@ -0,0 +1,13 @@
+---
+"karinto": patch
+---
+
+`dependabot-cooldown` now tracks zizmor 1.28.0, which taught the audit about GitHub's new implicit three-day default cooldown ([zizmorcore/zizmor#2193](https://github.com/zizmorcore/zizmor/issues/2193)).
+
+Three behavioural changes:
+
+- The pedantic-only "`multi-ecosystem-group` cooldowns do not batch updates correctly" finding is **gone**. An `updates:` entry that joins a `multi-ecosystem-group` while configuring a sufficient cooldown is now silent, matching upstream.
+- An entry with no `cooldown:` block, or one without `default-days`, now reports `insufficient implicit default-days (less than 7)` instead of `missing cooldown configuration` / `no default-days configured` — the entry does get a cooldown, GitHub's implicit one, it's just shorter than the threshold.
+- The rule's severity moves from `info` to `warning`, mirroring upstream: zizmor 1.28.0 promoted the too-short `default-days` case from `help` to `warning`, making every arm of the audit a `warning`. This also changes the SARIF `level` reported for the rule.
+
+An explicit `default-days` below 7 keeps its existing `insufficient default-days configured (less than 7)` wording.

DEVELOPMENT.md

@@ -84,7 +84,7 @@ captured by `wrangler tail`:
 
 `rules_catalog.mbt` is the source of truth for what karinto checks. Each
 entry carries an ID, human-readable title, source family (actionlint /
-zizmor / ghalint), upstream origins, category, severity, priority,
+zizmor / ghalint), upstream origins, category, severity,
 implementation status, and which file kinds it applies to.
 
 Of 83 catalogued rules, 68 are implemented; 8 are `Planned` — scaffolded as

fixtures/upstream/zizmor/UPSTREAM.txt

@@ -1,2 +1,2 @@
-zizmorcore/zizmor@v1.27.0
+zizmorcore/zizmor@v1.28.0
 vendored: crates/zizmor/tests -> tests

fixtures/upstream/zizmor/tests/integration/audit/dependabot_cooldown.rs

@@ -15,7 +15,7 @@ fn test_missing_cooldown() -> anyhow::Result<()> {
      --> @@INPUT@@:4:5
       |
     4 |   - package-ecosystem: pip
-      |     ^^^^^^^^^^^^^^^^^^^^^^ missing cooldown configuration
+      |     ^^^^^^^^^^^^^^^^^^^^^^ insufficient implicit default-days (less than 7)
       |
       = note: audit confidence → High
       = note: this finding has an auto-fix
@@ -40,7 +40,7 @@ fn test_no_default_days() -> anyhow::Result<()> {
      --> @@INPUT@@:6:5
       |
     6 |     cooldown: {}
-      |     ^^^^^^^^^^^^ no default-days configured
+      |     ^^^^^^^^^^^^ insufficient implicit default-days (less than 7)
       |
       = note: audit confidence → High
       = note: this finding has an auto-fix
@@ -60,16 +60,16 @@ fn test_default_days_too_short() -> anyhow::Result<()> {
             ))
             .run()?,
         @"
-    help[dependabot-cooldown]: insufficient cooldown in Dependabot updates
+    warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates
      --> @@INPUT@@:7:7
       |
     7 |       default-days: 2
       |       ^^^^^^^^^^^^^^^ insufficient default-days configured (less than 7)
       |
-      = note: audit confidence → Medium
+      = note: audit confidence → High
       = note: this finding has an auto-fix
 
-    1 findings (1 safe fixes): 0 informational, 1 low, 0 medium, 0 high
+    1 findings (1 safe fixes): 0 informational, 0 low, 1 medium, 0 high
     ");
 
     Ok(())
@@ -180,33 +180,7 @@ fn test_multi_ecosystem_group_with_cooldown() -> anyhow::Result<()> {
             ))
             .args(["--pedantic"])
             .run()?,
-        @"
-    help[dependabot-cooldown]: insufficient cooldown in Dependabot updates
-      --> @@INPUT@@:13:5
-       |
-    10 |       multi-ecosystem-group: all
-       |       --------------------- multi-ecosystem-group configured here
-    ...
-    13 | /     cooldown:
-    14 | |       default-days: 7
-       | |_____________________^ multi-ecosystem-group cooldowns do not batch updates correctly
-       |
-       = note: audit confidence → High
-
-    help[dependabot-cooldown]: insufficient cooldown in Dependabot updates
-      --> @@INPUT@@:20:5
-       |
-    17 |       multi-ecosystem-group: all
-       |       --------------------- multi-ecosystem-group configured here
-    ...
-    20 | /     cooldown:
-    21 | |       default-days: 7
-       | |______________________^ multi-ecosystem-group cooldowns do not batch updates correctly
-       |
-       = note: audit confidence → High
-
-    2 findings: 0 informational, 2 low, 0 medium, 0 high
-    "
+        @"No findings to report. Good job!"
     );
 
     Ok(())
@@ -223,7 +197,7 @@ fn test_opentofu_cooldown() -> anyhow::Result<()> {
      --> @@INPUT@@:5:5
       |
     5 |   - package-ecosystem: opentofu
-      |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^ missing cooldown configuration
+      |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^ insufficient implicit default-days (less than 7)
       |
       = note: audit confidence → High
       = note: this finding has an auto-fix

fixtures/upstream/zizmor/tests/integration/audit/github_env.rs

@@ -108,3 +108,21 @@ fn test_issue_1333() -> Result<()> {
 
     Ok(())
 }
+
+/// Reproducer for #2200. Insertions into `GITHUB_ENV` should not be flagged if they are
+/// entirely literal, i.e. have no variable expansions within them.
+///
+/// See: <https://github.com/zizmorcore/zizmor/issues/2200>
+#[test]
+fn test_issue_2200() -> Result<()> {
+    insta::assert_snapshot!(
+        zizmor()
+            .output(OutputMode::Both)
+            .setenv("RUST_LOG", "warn")
+            .input(input_under_test("github-env/issue-2200-repro.yml"))
+            .run()?,
+        @"No findings to report. Good job! (1 ignored)"
+    );
+
+    Ok(())
+}

fixtures/upstream/zizmor/tests/integration/audit/template_injection.rs

@@ -616,34 +616,6 @@ fn test_issue_1664() -> Result<()> {
     Ok(())
 }
 
-/// Repro case for #1903: parenthesized compound expressions in context
-/// position (e.g. `(a || b).foo`) should not crash zizmor.
-///
-/// See: <https://github.com/zizmorcore/zizmor/issues/1903>
-#[test]
-fn test_issue_1903() -> Result<()> {
-    insta::assert_snapshot!(
-        zizmor()
-            .input(input_under_test("template-injection/issue-1903-repro.yml"))
-            .run()?,
-        @r#"
-    info[template-injection]: code injection via template expansion
-      --> @@INPUT@@:21:24
-       |
-    21 |       - run: echo "${{ (github.event.pull_request || github.event.issue).number }}"
-       |         ---            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
-       |         |
-       |         this run block
-       |
-       = note: audit confidence → Low
-
-    1 finding: 1 informational, 0 low, 0 medium, 0 high
-    "#
-    );
-
-    Ok(())
-}
-
 /// Repro case for #1802: `needs.*.result` expressions should not be considered injection risks in the default persona.
 ///
 /// See: <https://github.com/zizmorcore/zizmor/issues/1802>
@@ -700,3 +672,47 @@ fn test_issue_1802() -> Result<()> {
 
     Ok(())
 }
+
+/// Repro case for #1903: parenthesized compound expressions in context
+/// position (e.g. `(a || b).foo`) should not crash zizmor.
+///
+/// See: <https://github.com/zizmorcore/zizmor/issues/1903>
+#[test]
+fn test_issue_1903() -> Result<()> {
+    insta::assert_snapshot!(
+        zizmor()
+            .input(input_under_test("template-injection/issue-1903-repro.yml"))
+            .run()?,
+        @r#"
+    info[template-injection]: code injection via template expansion
+      --> @@INPUT@@:21:24
+       |
+    21 |       - run: echo "${{ (github.event.pull_request || github.event.issue).number }}"
+       |         ---            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
+       |         |
+       |         this run block
+       |
+       = note: audit confidence → Low
+
+    1 finding: 1 informational, 0 low, 0 medium, 0 high
+    "#
+    );
+
+    Ok(())
+}
+
+/// Repro case for #2197: `steps.*.outcome` contexts should not be considered injection
+/// risks in the default persona.
+///
+/// See: <https://github.com/zizmorcore/zizmor/issues/2197>
+#[test]
+fn test_issue_2197() -> Result<()> {
+    insta::assert_snapshot!(
+        zizmor()
+            .input(input_under_test("template-injection/issue-2197-repro.yml"))
+            .run()?,
+        @"No findings to report. Good job! (1 suppressed)"
+    );
+
+    Ok(())
+}

fixtures/upstream/zizmor/tests/integration/cli.rs

@@ -115,7 +115,7 @@ updates:
      --> <stdin>:3:5
       |
     3 |   - package-ecosystem: github-actions
-      |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ missing cooldown configuration
+      |     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ insufficient implicit default-days (less than 7)
       |
       = note: audit confidence → High
       = note: this finding has an auto-fix

fixtures/upstream/zizmor/tests/integration/e2e.rs

@@ -615,7 +615,7 @@ fn issue_1300() -> Result<()> {
     Caused by:
         0: input @@INPUT@@ doesn't contain any workflows
         1: request error while accessing GitHub API
-        2: HTTP status client error (404 Not Found) for url (https://api.github.com/repos/@@INPUT@@/contents/.github/workflows)
+        2: HTTP status client error (404 Not Found) for url (https://api.github.com/repos/@@INPUT@@/contents/.github/workflows?ref=HEAD)
     "
     );
 
@@ -855,3 +855,37 @@ fn issue_2182() -> Result<()> {
 
     Ok(())
 }
+
+/// Regression test for #2202.
+///
+/// Ensures that we produce a reasonable error message when the user
+/// asks us to audit an ambiguous remote input (one where the @<ref>
+/// is both a branch and a tag).
+#[cfg_attr(not(feature = "gh-token-tests"), ignore)]
+#[test]
+fn issue_2202() -> Result<()> {
+    insta::assert_snapshot!(
+        zizmor()
+            .offline(NetworkMode::AssertOnline)
+            .output(OutputMode::Stderr)
+            .expects_failure(1)
+            .input(
+                "woodruffw-experiments/zizmor-issue-2202@v1"
+            )
+            .run()?,
+        @r#"
+     INFO zizmor: 🌈 zizmor v@@VERSION@@
+    fatal: no audit was performed
+    error: remote input has an ambiguous Git reference ("v1" is both a tag and a branch)
+      |
+      = help: disambiguate the Git ref by putting it in the right namespace
+      = help: example: woodruffw-experiments/zizmor-issue-2202@refs/heads/v1
+      = help: example: woodruffw-experiments/zizmor-issue-2202@refs/tags/v1
+
+    Caused by:
+        remote input has an ambiguous Git reference ("v1" is both a tag and a branch)
+    "#
+    );
+
+    Ok(())
+}

fixtures/upstream/zizmor/tests/integration/e2e/json_v1.rs

@@ -16,3 +16,18 @@ fn test_json_v1() {
 
     assert_snapshot!(output);
 }
+
+#[test]
+fn test_json_v1_fix_metadata() {
+    // A finding with an available fix exposes symbolic fix metadata
+    // (title, key, disposition) in its `fixes` array.
+    let output = zizmor()
+        .args(["--format=json-v1"])
+        .input(input_under_test(
+            "dependabot-execution/basic/dependabot.yml",
+        ))
+        .run()
+        .expect("Failed to run zizmor with JSON v1 format");
+
+    assert_snapshot!(output);
+}

fixtures/upstream/zizmor/tests/integration/e2e/snapshots/integration__e2e__crater__pyca_cryptography.snap

@@ -1,6 +1,6 @@
 ---
 source: crates/zizmor/tests/integration/e2e/crater.rs
-expression: "zizmor().offline(false).output(OutputMode::Both).args([\"--persona=pedantic\"]).input(\"pyca/cryptography@43eb178ee3aae8d0060221118437b03c23570a41\").run()?"
+expression: "zizmor().offline(NetworkMode::AssertOnline).output(OutputMode::Both).args([\"--persona=pedantic\"]).input(\"pyca/cryptography@43eb178ee3aae8d0060221118437b03c23570a41\").run()?"
 ---
  INFO zizmor: 🌈 zizmor v@@VERSION@@
  INFO collect_inputs: zizmor::registry::input: collected 15 inputs from pyca/cryptography
@@ -83,24 +83,6 @@ error[template-injection]: code injection via template expansion
    = note: audit confidence → High
    = note: this finding has an auto-fix
 
-warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates
-  --> .github/dependabot.yml:17:5
-   |
-17 |   - package-ecosystem: cargo
-   |     ^^^^^^^^^^^^^^^^^^^^^^^^ missing cooldown configuration
-   |
-   = note: audit confidence → High
-   = note: this finding has an auto-fix
-
-warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates
-  --> .github/dependabot.yml:28:5
-   |
-28 |   - package-ecosystem: uv
-   |     ^^^^^^^^^^^^^^^^^^^^^ missing cooldown configuration
-   |
-   = note: audit confidence → High
-   = note: this finding has an auto-fix
-
 warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/auto-close-stale.yml:1:1
    |
@@ -789,4 +771,4 @@ info[superfluous-actions]: action functionality is already included by the runne
    |
    = note: audit confidence → Low
 
-80 findings (9 suppressed): 19 informational, 35 low, 7 medium, 10 high
+78 findings (9 suppressed): 19 informational, 35 low, 5 medium, 10 high

fixtures/upstream/zizmor/tests/integration/e2e/snapshots/integration__e2e__crater__warehouse.snap

@@ -1,6 +1,6 @@
 ---
 source: crates/zizmor/tests/integration/e2e/crater.rs
-expression: "zizmor().offline(false).output(OutputMode::Both).args([\"--persona=pedantic\"]).input(\"pypi/warehouse@9ed30d191788fcfa9c5be56bcce9b743e758903e\").run()?"
+expression: "zizmor().offline(NetworkMode::AssertOnline).output(OutputMode::Both).args([\"--persona=pedantic\"]).input(\"pypi/warehouse@9ed30d191788fcfa9c5be56bcce9b743e758903e\").run()?"
 ---
  INFO zizmor: 🌈 zizmor v@@VERSION@@
  INFO collect_inputs: zizmor::registry::input: collected 8 inputs from pypi/warehouse
@@ -16,7 +16,7 @@ warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates
  --> .github/dependabot.yml:4:3
   |
 4 | - package-ecosystem: pip
-  |   ^^^^^^^^^^^^^^^^^^^^^^ missing cooldown configuration
+  |   ^^^^^^^^^^^^^^^^^^^^^^ insufficient implicit default-days (less than 7)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
@@ -25,7 +25,7 @@ warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates
   --> .github/dependabot.yml:29:3
    |
 29 | - package-ecosystem: github-actions
-   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ missing cooldown configuration
+   |   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ insufficient implicit default-days (less than 7)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
@@ -34,7 +34,7 @@ warning[dependabot-cooldown]: insufficient cooldown in Dependabot updates
   --> .github/dependabot.yml:33:3
    |
 33 | - package-ecosystem: docker
-   |   ^^^^^^^^^^^^^^^^^^^^^^^^^ missing cooldown configuration
+   |   ^^^^^^^^^^^^^^^^^^^^^^^^^ insufficient implicit default-days (less than 7)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
@@ -357,4 +357,3 @@ help[concurrency-limits]: insufficient job-level concurrency limits
    = note: audit confidence → High
 
 34 findings (2 suppressed): 4 informational, 14 low, 8 medium, 6 high
-