Say why the Action Text job installs gems ad hoc, for zizmor 1.30 - #1358
Say why the Action Text job installs gems ad hoc, for zizmor 1.30#1358jeremy wants to merge 2 commits into
Conversation
zizmor 1.30.0's adhoc-packages audit now recognizes `bundle add`, and the Action Text job runs it twice on purpose: to pin json 2.x with a version written in the workflow, for the reason the comment above it gives, and to install the gem under test from this checkout, which is the point of the job. The ignore says so on the step, so the audit stays green when zizmor-action moves past 0.6.2 (#1320 takes it there; the next bump runs 1.30).
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
🟢 Approved
The change is limited to workflow documentation for a zizmor ignore and does not alter runtime behavior.
Pull request overview
This PR updates the CI workflow to document why the Action Text job intentionally installs gems ad hoc, so zizmor 1.30’s adhoc-packages audit can be safely ignored with a clear rationale.
Changes:
- Adds an inline
zizmor: ignore[adhoc-packages]justification to the Action Text “Configure Rails” step to explain the intentionalbundle addusage.
[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or rungh pr ready --undo.
Click "Ready for review" or rungh pr readyto reengage.
File summaries
| File | Description |
|---|---|
| .github/workflows/ci.yml | Documents why the Action Text job’s ad hoc gem installs are intentional and should be ignored by zizmor’s adhoc-packages audit. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
zizmor 1.30.0 (what zizmor-action 0.6.3 runs) teaches its
adhoc-packagesaudit to recognizebundle add, and the Action Text job runs it twice on purpose: once to pin json 2.x with a version written in the workflow, for the reason the comment above it already gives, and once to install the gem under test from this checkout, which is the point of the job. Neither is the drift the audit is after, so the step carries azizmor: ignore[adhoc-packages]with that reason.Run online with zizmor 1.30.0 at the
regularpersona the action uses: two findings before, none after. This repo is on zizmor-action 0.5.3 and #1320 moves it to 0.6.2 (zizmor 1.29, which does not flag these); the bump after that would have gone red here.