ci: fix zizmor findings - #1462
Ron (rjaegers) wants to merge 3 commits into
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
Critical workflow references are invalid and will prevent the affected workflows from running.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
This PR updates GitHub Actions reusable-workflow references to address zizmor findings.
Changes:
- Replaced local
./.github/workflows/...references with$/.github/workflows/.... - Applied changes across five build, CI, test, and release workflows.
File summaries
| File | Summary |
|---|---|
.github/workflows/wc-build-push.yml |
Contains an invalid reusable-workflow reference. |
.github/workflows/wc-build-push-test.yml |
Contains multiple invalid reusable-workflow references. |
.github/workflows/release-build.yml |
Contains multiple invalid reusable-workflow references. |
.github/workflows/continuous-integration.yml |
Contains multiple invalid reusable-workflow references. |
.github/workflows/build-push-test.yml |
Contains multiple invalid reusable-workflow references. |
Review details
Suppressed comments (8)
.github/workflows/build-push-test.yml:57
jobs.build-push-test-flavors.usesmust use a local reusable-workflow path beginning with./(or a fully qualified repository reference with@ref);$/.github/workflows/wc-build-push-test.ymlis not a valid GitHub Actions workflow reference, so the flavor matrix job cannot run. Restore the./.github/...path.
uses: $/.github/workflows/wc-build-push-test.yml
.github/workflows/continuous-integration.yml:36
jobs.dependency-review.usesmust use a local reusable-workflow path beginning with./(or a fully qualified repository reference with@ref);$/.github/workflows/wc-dependency-review.ymlis not a valid GitHub Actions workflow reference, so this CI job will be rejected before it runs. Restore the./.github/...path.
uses: $/.github/workflows/wc-dependency-review.yml
.github/workflows/continuous-integration.yml:66
jobs.generate-documents.usesmust use a local reusable-workflow path beginning with./(or a fully qualified repository reference with@ref);$/.github/workflows/wc-document-generation.ymlis not a valid GitHub Actions workflow reference, so this CI job will be rejected before it runs. Restore the./.github/...path.
uses: $/.github/workflows/wc-document-generation.yml
.github/workflows/release-build.yml:133
jobs.publish-devcontainer-templates.usesmust use a local reusable-workflow path beginning with./(or a fully qualified repository reference with@ref);$/.github/workflows/wc-publish-templates.ymlis not a valid GitHub Actions workflow reference, so this release job cannot run. Restore the./.github/...path.
uses: $/.github/workflows/wc-publish-templates.yml
.github/workflows/release-build.yml:140
jobs.generate-documents.usesmust use a local reusable-workflow path beginning with./(or a fully qualified repository reference with@ref);$/.github/workflows/wc-document-generation.ymlis not a valid GitHub Actions workflow reference, so this release job cannot run. Restore the./.github/...path.
uses: $/.github/workflows/wc-document-generation.yml
.github/workflows/wc-build-push-test.yml:161
jobs.integration-test-docker.usesmust use a local reusable-workflow path beginning with./(or a fully qualified repository reference with@ref);$/.github/workflows/wc-integration-test-docker.ymlis not a valid GitHub Actions workflow reference, so this integration-test job cannot run. Restore the./.github/...path.
uses: $/.github/workflows/wc-integration-test-docker.yml
.github/workflows/wc-build-push-test.yml:178
jobs.integration-test-podman.usesmust use a local reusable-workflow path beginning with./(or a fully qualified repository reference with@ref);$/.github/workflows/wc-integration-test-podman.ymlis not a valid GitHub Actions workflow reference, so this integration-test job cannot run. Restore the./.github/...path.
uses: $/.github/workflows/wc-integration-test-podman.yml
.github/workflows/wc-build-push-test.yml:188
jobs.acceptance-test.usesmust use a local reusable-workflow path beginning with./(or a fully qualified repository reference with@ref);$/.github/workflows/wc-acceptance-test.ymlis not a valid GitHub Actions workflow reference, so this acceptance-test job cannot run. Restore the./.github/...path.
uses: $/.github/workflows/wc-acceptance-test.yml
- Files reviewed: 5/5 changed files
- Comments generated: 5
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| build-push-test-base: | ||
| name: 🍨 base | ||
| uses: ./.github/workflows/wc-build-push-test.yml | ||
| uses: $/.github/workflows/wc-build-push-test.yml |
| build-push-test: | ||
| name: Build → Push → Test | ||
| uses: ./.github/workflows/build-push-test.yml | ||
| uses: $/.github/workflows/build-push-test.yml |
| name: Build → Push → Test | ||
| if: ${{ !startsWith(github.ref_name, 'actions/') }} | ||
| uses: ./.github/workflows/build-push-test.yml | ||
| uses: $/.github/workflows/build-push-test.yml |
| build-push: | ||
| name: 🛠️ | ||
| uses: ./.github/workflows/wc-build-push.yml | ||
| uses: $/.github/workflows/wc-build-push.yml |
| sanitize-image-name: | ||
| name: 🧼 | ||
| uses: ./.github/workflows/wc-sanitize-image-name.yml | ||
| uses: $/.github/workflows/wc-sanitize-image-name.yml |
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|
|
❌MegaLinter analysis: Error
Detailed Issues❌ ACTION / actionlint - 13 errors
|
|
Waiting on rhysd/actionlint#732. Followed by an intake into MegaLinter. |
📦 Container Size AnalysisNote Comparing 📈 Size Comparison Table
|




🚀 Hey, I have created a Pull Request
Description of changes
This pull request updates several GitHub Actions workflow files to change how reusable workflows are referenced. The main change is replacing relative paths (e.g.,
./.github/workflows/...) with a new syntax using a$prefix (e.g.,$/.github/workflows/...). This affects multiple workflows and their job steps, ensuring consistency and possibly preparing for a new workflow resolution mechanism.Workflow reference updates:
.github/workflows/build-push-test.yml,.github/workflows/continuous-integration.yml,.github/workflows/release-build.yml,.github/workflows/wc-build-push-test.yml, and.github/workflows/wc-build-push.ymlto use the `# 🚀 Hey, I have created a Pull RequestDescription of changes
prefix instead of the previous relative path syntax. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12]
No other functional or logic changes are introduced in this pull request.
✔️ Checklist