From 9104f8ab98191347b435e2c4964ec5df262b72c5 Mon Sep 17 00:00:00 2001 From: Joshua Date: Thu, 22 Oct 2026 08:47:05 -0500 Subject: [PATCH] ci: scope the existing zizmor annotation to workflow_run --- .github/workflows/auto-fix.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/auto-fix.yml b/.github/workflows/auto-fix.yml index e75d30f..f5c7709 100644 --- a/.github/workflows/auto-fix.yml +++ b/.github/workflows/auto-fix.yml @@ -12,12 +12,12 @@ name: Auto-fix # re-triggers Validate (GITHUB_TOKEN pushes would not). Human PRs are never # auto-mutated. on: - # zizmor: ignore[dangerous-triggers] workflow_run is required by design (react to + # workflow_run is required by design (react to # Validate FAILING and re-trigger CI after the App-token ref update); it runs in # the base-repo context. The PR head is referenced only as a Git Data API # parameter (base tree + parent) — never checked out, fetched, or executed — so # no untrusted code runs at elevated privilege. - workflow_run: + workflow_run: # zizmor: ignore[dangerous-triggers] workflows: [Validate] types: [completed]