[BUG]: Booleans written as strings are not handled correctly

[frouioui]

Pre-submission checks

• I am not filing a feature request. These should be filed via the feature request form instead.
• I have looked through the open issues for a duplicate report.

Expected behavior

When I write a boolean value between quotes (e.g. 'false') I expect it to be treated as a boolean equal to false, and not a string containing false. Which is what yaml and GHA do.

I want to be able to write the following snippet in my workflow and have zizmor not issue any warning saying that persist-credentials should be set to false.

    - name: Check out code
      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        persist-credentials: 'false'

Actual behavior

Right now zizmor emits a warning when using the snippet pasted above:

2025-01-14T23:01:19.684524Z  WARN zizmor: skipping impostor-commit: can't run without a GitHub API token
2025-01-14T23:01:19.684741Z  WARN zizmor: skipping ref-confusion: can't run without a GitHub API token
2025-01-14T23:01:19.684752Z  WARN zizmor: skipping known-vulnerable-actions: can't run without a GitHub API token
2025-01-14T23:01:19.714096Z  INFO audit: zizmor: 🌈 completed /aaaa/.github/workflows/create_release.yml
warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> /aaaa/.github/workflows/create_release.yml:19:7
   |
19 |       - name: Check out code
   |  _______-
20 | |       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
21 | |       with:
22 | |         persist-credentials: 'false'
   | |____________________________________- does not set persist-credentials: false
   |
   = note: audit confidence → Low

2 findings (1 suppressed): 0 unknown, 0 informational, 0 low, 1 medium, 0 high

Despite the warning, the value is correctly set to false on GitHub Actions:

Reproduction steps

1. Use the following step:

   steps:
   - name: Check out code
     uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
     with:
       persist-credentials: 'false'

2. Run zizmor on the yaml file and observe the warning.

Logs

No response

Additional context

No response

[woodruffw]

Thanks for the report @frouioui!

FWIW this is a GHA-ism, not a YAML-ism: true and 'true' are distinct types in YAML, but GHA considers them the same (this is a side effect of expression expansion always returning strings, AFAICT).

Regardless, this is indeed a bug in zizmor itself, since we should be doing what GHA does and not just what YAML does 🙂. I'll look into a fix now!

[frouioui]

That's a good point, thanks for the clarification 🙇🏻

[woodruffw]

#448 should fix this!

[frouioui]

Awesome, thanks for the quick turnaround!