Configure Zizmor to allow unpinned actions in actions/* namespace

[Copilot]

Configured zizmor to use a practical policy for action pinning in GitHub Actions workflows, allowing unpinned actions in the actions/* namespace.

Changes

• .zizmor.yml: Created configuration file to allow any reference type (tags, branches) for actions in the actions/* namespace while enforcing hash pinning for third-party actions. This reduces noise from official GitHub actions while maintaining security for untrusted actions.

• .github/workflows/zizmor.yml: Updated to use the new configuration file when running zizmor analysis.

Impact

High severity findings reduced from 68 to 17. Only third-party actions now require hash pins, while official GitHub actions (like actions/checkout@v5) can use tag references.

Original prompt

We use zizmor to scan our GitHub actions. Since we started using it, it has gotten stricter about pinning actions to specific versions. Please use zizmor --fix on our workflows to apply any fixes it can make automatically.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

---

This change is 

[Nateowami]

@copilot Can you configure Zizmor to not care about pinning actions in the actions/ namespace?

Also, can you explain what the cooldown actually does? Can you link to the exact documentation?

[Copilot]

@copilot Can you configure Zizmor to not care about pinning actions in the actions/ namespace?

Also, can you explain what the cooldown actually does? Can you link to the exact documentation?

Configured zizmor to allow any reference type for actions/* namespace in commit 0ef2410. Created .zizmor.yml with a policy that uses any for actions/* and hash-pin for all other actions.

The cooldown configuration sets a minimum age for dependency updates. With default-days: 7, Dependabot will only create PRs for dependency versions that have been available for at least 7 days. This reduces noise from frequent updates and helps avoid immediately adopting potentially problematic releases.

Documentation: https://docs.github.com/en/code-security/reference/supply-chain-security/dependabot-options-reference#cooldown

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• docs.zizmor.sh
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.52%. Comparing base (6563e48) to head (1584b5a).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #3646   +/-   ##
=======================================
  Coverage   83.52%   83.52%           
=======================================
  Files         610      610           
  Lines       37512    37512           
  Branches     6172     6148   -24     
=======================================
  Hits        31332    31332           
- Misses       5226     5239   +13     
+ Partials      954      941   -13     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Nateowami]

@copilot Can you break the two changes into two PRs? If you can't, please just keep the changes for allowing unpinned actions. Also update the PR title

[Copilot]

@copilot Can you break the two changes into two PRs? If you can't, please just keep the changes for allowing unpinned actions. Also update the PR title

I cannot create separate PRs, but I've removed the Dependabot cooldown changes in commit 1584b5a. The PR now only contains the zizmor configuration changes to allow unpinned actions in the actions/* namespace.

The PR title has been updated to "Configure zizmor to allow unpinned actions in actions/* namespace".

[Nateowami]

@Nateowami reviewed 2 files and all commit messages, and made 1 comment.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on @copilot[bot]).

[Nateowami]

This is intended to fix the 99 or so zizmor errors on master.