From d56c6fd77fb9be51e80639a7356fe1838b6b6721 Mon Sep 17 00:00:00 2001 From: Steve Beattie Date: Mon, 2 Nov 2026 15:53:20 -0800 Subject: [PATCH] ci(zizmor): bump zizmor-action to v0.8.0 and allow PyPI egress Since v0.7.0, zizmor-action installs zizmor by downloading a hash-pinned wheel from PyPI instead of pulling a container image from ghcr.io. This workflow is still on v0.5.2, which pulls the container image. Bumping the action without changing the harden-runner egress allowlist would break the job, because pip can't reach PyPI under the block policy, so both change together. Allow pypi.org and files.pythonhosted.org, drop the container registry endpoints that are no longer used, and bump the action to v0.8.0. This matches chainguard-dev/actions#1134. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/zizmor.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml index 4d0ad6a..47e3bc0 100644 --- a/.github/workflows/zizmor.yaml +++ b/.github/workflows/zizmor.yaml @@ -33,9 +33,9 @@ jobs: egress-policy: block allowed-endpoints: > api.github.com:443 + files.pythonhosted.org:443 github.com:443 - pkg-containers.githubusercontent.com:443 - ghcr.io + pypi.org:443 - name: Check out code uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -43,4 +43,4 @@ jobs: persist-credentials: false - name: Run zizmor - uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2 + uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0