From dd7e41b232ec532213c4bcced8bada0502548672 Mon Sep 17 00:00:00 2001 From: Nigel Jones Date: Tue, 11 Aug 2026 11:19:08 +0100 Subject: [PATCH 1/5] feat: add zizmor audit job to CI quality workflow Adds a zizmor static analysis job to the reusable quality workflow, running on every PR via ci.yml. The job fails on findings, which blocks PR merges natively. - advanced-security: false so the job exit code gates the PR check - GH_TOKEN set from github.token to enable online audits (impostor commits, ref-confusion, typosquat-uses, known-vulnerable-actions) - contents: read only; no additional secrets required - SHA-pinned at zizmorcore/zizmor-action v0.6.2 - Existing zizmor: ignore[] annotations suppress known intentional exceptions (dangerous-triggers on hold/pr-label/pr-update, secrets-outside-env on HF_TOKEN steps) Closes #331 Assisted-by: IBM Bob Signed-off-by: Nigel Jones --- .github/workflows/quality.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index 894fecc9a..c3f9f2d83 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -27,6 +27,21 @@ jobs: - name: Lint GitHub Actions workflows uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.1.2 + zizmor: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + with: + persist-credentials: false + - name: Audit GitHub Actions workflows with zizmor + uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 + with: + advanced-security: false + env: + GH_TOKEN: ${{ github.token }} + license-headers: runs-on: ubuntu-latest permissions: From 724b7ba2a102ee7349106d856040474fea8345e9 Mon Sep 17 00:00:00 2001 From: Nigel Jones Date: Tue, 11 Aug 2026 11:58:12 +0100 Subject: [PATCH 2/5] fix: suppress pre-existing zizmor findings to green the CI gate Adds .github/zizmor.yml with per-line ignore rules for all pre-existing findings discovered when the zizmor CI job ran for the first time. Each suppressed finding has a corresponding open issue (to be filed); the definition of done for each issue is: fix the root cause AND remove the suppression entry. Also corrects stale version comments on SHA-pinned actions (# v6 -> # v6.0.2, # v5 -> # v5.0.5, etc.) where those were mechanical and safe. Findings suppressed (all pre-existing, none introduced by this PR): - ref-version-mismatch: stale version comments across 7 files - unpinned-uses: actions/create-github-app-token@v1 in release workflows - github-app: app token permission scoping in release workflows - template-injection: workflow_dispatch inputs in dispatch-to-contribs.yml - cache-poisoning: setup-uv/setup-node caching in docs-publish.yml - excessive-permissions: missing permissions block in dispatch-to-contribs.yml - artipacked: implicit credential persistence in publish-release.yml snapshot job New violations in any of these rules on any OTHER line will still fail CI. Assisted-by: IBM Bob Signed-off-by: Nigel Jones --- .github/workflows/cut-release-branch.yml | 2 +- .github/workflows/docs-publish.yml | 4 +- .github/workflows/pr-update.yml | 2 +- .github/workflows/publish-dev-from-main.yml | 2 +- .github/workflows/publish-release.yml | 6 +- .github/workflows/pypi.yml | 4 +- .github/workflows/quality.yml | 11 ++- .github/zizmor.yml | 100 ++++++++++++++++++++ 8 files changed, 116 insertions(+), 15 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/cut-release-branch.yml b/.github/workflows/cut-release-branch.yml index c4ab88e8e..96861162e 100644 --- a/.github/workflows/cut-release-branch.yml +++ b/.github/workflows/cut-release-branch.yml @@ -37,7 +37,7 @@ jobs: with: app-id: ${{ vars.CI_APP_ID }} private-key: ${{ secrets.CI_PRIVATE_KEY }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: main token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/docs-publish.yml b/.github/workflows/docs-publish.yml index ff5bc61e8..1dbb53e4f 100644 --- a/.github/workflows/docs-publish.yml +++ b/.github/workflows/docs-publish.yml @@ -66,7 +66,7 @@ jobs: steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: false @@ -263,7 +263,7 @@ jobs: if: >- steps.latest_check.conclusion == 'skipped' || steps.latest_check.outputs.is_latest_final != 'false' - uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4 + uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} publish_branch: gh-pages diff --git a/.github/workflows/pr-update.yml b/.github/workflows/pr-update.yml index ea48da246..a0bdda9ec 100644 --- a/.github/workflows/pr-update.yml +++ b/.github/workflows/pr-update.yml @@ -26,7 +26,7 @@ jobs: contents: read steps: - name: Checkout code # Checks out the base branch, not PR branch. - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false diff --git a/.github/workflows/publish-dev-from-main.yml b/.github/workflows/publish-dev-from-main.yml index 8bfc88e99..ba1b34eaf 100644 --- a/.github/workflows/publish-dev-from-main.yml +++ b/.github/workflows/publish-dev-from-main.yml @@ -46,7 +46,7 @@ jobs: with: app-id: ${{ vars.CI_APP_ID }} private-key: ${{ secrets.CI_PRIVATE_KEY }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: main token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml index f1e94e8d6..b8b19ea86 100644 --- a/.github/workflows/publish-release.yml +++ b/.github/workflows/publish-release.yml @@ -70,7 +70,7 @@ jobs: outputs: TARGET_TAG_V: ${{ steps.version_check.outputs.TRGT_VERSION }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: fetch-depth: 0 persist-credentials: false @@ -113,7 +113,7 @@ jobs: with: app-id: ${{ vars.CI_APP_ID }} private-key: ${{ secrets.CI_PRIVATE_KEY }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: ${{ github.ref_name }} token: ${{ steps.app-token.outputs.token }} @@ -165,7 +165,7 @@ jobs: with: app-id: ${{ vars.CI_APP_ID }} private-key: ${{ secrets.CI_PRIVATE_KEY }} - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: ref: main token: ${{ steps.app-token.outputs.token }} diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml index 97b3a3a2c..1055fa78e 100644 --- a/.github/workflows/pypi.yml +++ b/.github/workflows/pypi.yml @@ -27,7 +27,7 @@ jobs: permissions: id-token: write # IMPORTANT: mandatory for trusted publishing steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Decide whether to publish @@ -62,6 +62,6 @@ jobs: run: uv build - name: Publish distribution 📦 to PyPI if: steps.gate.outputs.skip != 'true' - uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1 + uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0 with: attestations: true diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index c3f9f2d83..c8b732a53 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -21,7 +21,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Lint GitHub Actions workflows @@ -32,13 +32,14 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Audit GitHub Actions workflows with zizmor uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 with: advanced-security: false + config: .github/zizmor.yml env: GH_TOKEN: ${{ github.token }} @@ -47,7 +48,7 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Check SPDX license headers @@ -66,7 +67,7 @@ jobs: # specific steps that need it, to limit exposure to unrelated steps like the # Ollama installer. Rotate via repo Settings -> Secrets and variables. steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Free disk space @@ -78,7 +79,7 @@ jobs: enable-cache: true - name: pre-commit cache key run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> "$GITHUB_ENV" - - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5 + - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 with: path: ~/.cache/pre-commit key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml', 'uv.lock') }} diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 000000000..defb5ae76 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,100 @@ +# zizmor configuration — ignore rules for pre-existing findings +# +# Each entry here suppresses a known, pre-existing finding that predates the +# introduction of zizmor CI enforcement. New occurrences of the same rule in +# different files or on different lines are NOT suppressed and will fail CI. +# +# Each group of ignores has a corresponding open issue that tracks the +# underlying fix. When a fix lands, remove the relevant ignore entries here. +# +# Rule reference: https://docs.zizmor.sh/audits/ + +rules: + + # --- ref-version-mismatch --------------------------------------------------- + # Version comments on SHA-pinned actions are stale (e.g. "# v6" should be + # "# v6.0.2"). SHAs are correct and immutable; comments are cosmetic only. + # Fix tracked in: + ref-version-mismatch: + ignore: + - cut-release-branch.yml:40 + - docs-publish.yml:69 + - docs-publish.yml:266 + - pr-update.yml:29 + - publish-dev-from-main.yml:49 + - publish-release.yml:73 + - publish-release.yml:116 + - publish-release.yml:168 + - pypi.yml:30 + - pypi.yml:65 + - quality.yml:24 + - quality.yml:35 + - quality.yml:54 + - quality.yml:66 + + # --- unpinned-uses ---------------------------------------------------------- + # actions/create-github-app-token is referenced by tag (@v1) rather than a + # commit SHA across all release workflows. These workflows are + # workflow_dispatch-only and require maintainer write access to trigger, so + # the external attacker surface is low, but SHA-pinning is the right fix. + # Fix tracked in: + unpinned-uses: + ignore: + - cut-release-branch.yml:35 + - dispatch-to-contribs.yml:44 + - publish-dev-from-main.yml:44 + - publish-release.yml:111 + - publish-release.yml:163 + + # --- github-app ------------------------------------------------------------- + # GitHub App tokens are created without explicit permission scoping in the + # release workflows. The tokens are used for legitimate release automation + # (push commits/tags, open PRs, dispatch workflows), but the permission set + # should be narrowed to the minimum required. + # Fix tracked in: + github-app: + ignore: + - cut-release-branch.yml:35 + - dispatch-to-contribs.yml:44 + - publish-dev-from-main.yml:44 + - publish-release.yml:111 + - publish-release.yml:163 + + # --- template-injection ----------------------------------------------------- + # workflow_dispatch inputs used directly in run: blocks in + # dispatch-to-contribs.yml. The workflow is dispatch-only (requires + # maintainer write access); no external attacker trigger path exists. + # The fix is to route inputs through env vars per AGENTS.md convention. + # Fix tracked in: + template-injection: + ignore: + - dispatch-to-contribs.yml:33 + - dispatch-to-contribs.yml:34 + - dispatch-to-contribs.yml:59 + + # --- cache-poisoning -------------------------------------------------------- + # astral-sh/setup-uv and actions/setup-node use caching in the + # docs-publish build-and-validate job, which is triggered on push to main. + # The cache-poisoning risk requires write access to main (branch-protected), + # so no external attacker trigger path exists. + # Fix tracked in: + cache-poisoning: + ignore: + - docs-publish.yml:75 + - docs-publish.yml:81 + + # --- excessive-permissions -------------------------------------------------- + # dispatch-to-contribs.yml has no permissions: block, so it inherits the + # repo default. The workflow is release-triggered and dispatch-only. + # Fix tracked in: + excessive-permissions: + ignore: + - dispatch-to-contribs.yml:20 + + # --- artipacked ------------------------------------------------------------- + # publish-release.yml snapshot-docs job uses persist-credentials implicitly + # (no persist-credentials: false) because it pushes commits to main. + # Fix tracked in: + artipacked: + ignore: + - publish-release.yml:168 From 2464f43a7fb6bcaf0e62e26559f4ad94846a426c Mon Sep 17 00:00:00 2001 From: Nigel Jones Date: Wed, 12 Aug 2026 09:23:40 +0100 Subject: [PATCH 3/5] fix: link zizmor suppression groups to their tracking issues Replaces the "" placeholders in .github/zizmor.yml with the follow-up issues (#1531-#1534) filed for each finding group, addressing review feedback that placeholders shouldn't ship unfilled. Assisted-by: Claude Code Signed-off-by: Nigel Jones --- .github/zizmor.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index defb5ae76..885f6321a 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -14,7 +14,7 @@ rules: # --- ref-version-mismatch --------------------------------------------------- # Version comments on SHA-pinned actions are stale (e.g. "# v6" should be # "# v6.0.2"). SHAs are correct and immutable; comments are cosmetic only. - # Fix tracked in: + # Fix tracked in: https://github.com/generative-computing/mellea/issues/1533 ref-version-mismatch: ignore: - cut-release-branch.yml:40 @@ -37,7 +37,7 @@ rules: # commit SHA across all release workflows. These workflows are # workflow_dispatch-only and require maintainer write access to trigger, so # the external attacker surface is low, but SHA-pinning is the right fix. - # Fix tracked in: + # Fix tracked in: https://github.com/generative-computing/mellea/issues/1531 unpinned-uses: ignore: - cut-release-branch.yml:35 @@ -51,7 +51,7 @@ rules: # release workflows. The tokens are used for legitimate release automation # (push commits/tags, open PRs, dispatch workflows), but the permission set # should be narrowed to the minimum required. - # Fix tracked in: + # Fix tracked in: https://github.com/generative-computing/mellea/issues/1531 github-app: ignore: - cut-release-branch.yml:35 @@ -65,7 +65,7 @@ rules: # dispatch-to-contribs.yml. The workflow is dispatch-only (requires # maintainer write access); no external attacker trigger path exists. # The fix is to route inputs through env vars per AGENTS.md convention. - # Fix tracked in: + # Fix tracked in: https://github.com/generative-computing/mellea/issues/1532 template-injection: ignore: - dispatch-to-contribs.yml:33 @@ -77,7 +77,7 @@ rules: # docs-publish build-and-validate job, which is triggered on push to main. # The cache-poisoning risk requires write access to main (branch-protected), # so no external attacker trigger path exists. - # Fix tracked in: + # Fix tracked in: https://github.com/generative-computing/mellea/issues/1534 cache-poisoning: ignore: - docs-publish.yml:75 @@ -86,7 +86,7 @@ rules: # --- excessive-permissions -------------------------------------------------- # dispatch-to-contribs.yml has no permissions: block, so it inherits the # repo default. The workflow is release-triggered and dispatch-only. - # Fix tracked in: + # Fix tracked in: https://github.com/generative-computing/mellea/issues/1534 excessive-permissions: ignore: - dispatch-to-contribs.yml:20 @@ -94,7 +94,7 @@ rules: # --- artipacked ------------------------------------------------------------- # publish-release.yml snapshot-docs job uses persist-credentials implicitly # (no persist-credentials: false) because it pushes commits to main. - # Fix tracked in: + # Fix tracked in: https://github.com/generative-computing/mellea/issues/1534 artipacked: ignore: - publish-release.yml:168 From 950a82db352e40696ea012520d42d24623cd9eae Mon Sep 17 00:00:00 2001 From: Nigel Jones Date: Wed, 12 Aug 2026 09:32:02 +0100 Subject: [PATCH 4/5] refactor: move zizmor audit out of the release-blocking quality gate quality.yml is called by both ci.yml (PR merge gate) and publish-release.yml (code-checks, required for release). zizmor audits the CI/CD workflow files themselves rather than the code being released, so a new finding there shouldn't be able to block a release the way a ruff/mypy/test failure can. Move the zizmor job into its own reusable workflow (actions-audit.yml) and wire it into ci.yml only. Verified locally with actionlint and zizmor (offline mode): no new findings, existing suppressions still apply. Assisted-by: Claude Code Signed-off-by: Nigel Jones --- .github/workflows/actions-audit.yml | 27 +++++++++++++++++++++++++++ .github/workflows/ci.yml | 5 +++++ .github/workflows/quality.yml | 16 ---------------- 3 files changed, 32 insertions(+), 16 deletions(-) create mode 100644 .github/workflows/actions-audit.yml diff --git a/.github/workflows/actions-audit.yml b/.github/workflows/actions-audit.yml new file mode 100644 index 000000000..4a4cb996a --- /dev/null +++ b/.github/workflows/actions-audit.yml @@ -0,0 +1,27 @@ +name: Audit GitHub Actions Workflows + +# Kept separate from quality.yml so it is only wired into ci.yml (the PR merge +# gate), not into publish-release.yml. zizmor audits the CI/CD workflow files +# themselves rather than the code being released, so a new finding here +# shouldn't be able to block a release the way a ruff/mypy/test failure can. +on: + workflow_call: {} + +permissions: {} + +jobs: + zizmor: + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + - name: Audit GitHub Actions workflows with zizmor + uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 + with: + advanced-security: false + config: .github/zizmor.yml + env: + GH_TOKEN: ${{ github.token }} diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7d357bdf0..df5a8f1ef 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -23,3 +23,8 @@ jobs: secrets: HF_TOKEN_READ_PUBLIC_ONLY: ${{ secrets.HF_TOKEN_READ_PUBLIC_ONLY }} + actions-audit: + permissions: + contents: read + uses: ./.github/workflows/actions-audit.yml + diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml index c8b732a53..24d79886f 100644 --- a/.github/workflows/quality.yml +++ b/.github/workflows/quality.yml @@ -27,22 +27,6 @@ jobs: - name: Lint GitHub Actions workflows uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.1.2 - zizmor: - runs-on: ubuntu-latest - permissions: - contents: read - steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - with: - persist-credentials: false - - name: Audit GitHub Actions workflows with zizmor - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 - with: - advanced-security: false - config: .github/zizmor.yml - env: - GH_TOKEN: ${{ github.token }} - license-headers: runs-on: ubuntu-latest permissions: From 1a78bfc5018186893cebb67aa7b3e2ccc9c43886 Mon Sep 17 00:00:00 2001 From: Nigel Jones Date: Mon, 17 Aug 2026 10:05:27 +0100 Subject: [PATCH 5/5] fix: drop dead ref-version-mismatch zizmor suppression The version comments the ignores referenced (e.g. "# v6" -> "# v6.0.2") were already corrected in this PR, so the rule no longer fires on any of the 14 previously-ignored lines. Verified with zizmor 1.29.0 at both default and pedantic personas: removing the group leaves the result identical (20 ignored, 36 suppressed, 0 findings). Dropping the suppression keeps the rule enforced everywhere going forward instead of leaving blind spots on those specific lines. #1533 can be closed as already fixed by this PR. Assisted-by: Claude Code Signed-off-by: Nigel Jones --- .github/zizmor.yml | 21 --------------------- 1 file changed, 21 deletions(-) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 885f6321a..62d3a2f64 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -11,27 +11,6 @@ rules: - # --- ref-version-mismatch --------------------------------------------------- - # Version comments on SHA-pinned actions are stale (e.g. "# v6" should be - # "# v6.0.2"). SHAs are correct and immutable; comments are cosmetic only. - # Fix tracked in: https://github.com/generative-computing/mellea/issues/1533 - ref-version-mismatch: - ignore: - - cut-release-branch.yml:40 - - docs-publish.yml:69 - - docs-publish.yml:266 - - pr-update.yml:29 - - publish-dev-from-main.yml:49 - - publish-release.yml:73 - - publish-release.yml:116 - - publish-release.yml:168 - - pypi.yml:30 - - pypi.yml:65 - - quality.yml:24 - - quality.yml:35 - - quality.yml:54 - - quality.yml:66 - # --- unpinned-uses ---------------------------------------------------------- # actions/create-github-app-token is referenced by tag (@v1) rather than a # commit SHA across all release workflows. These workflows are