Bump the version-comment sync's zizmor pin to 1.30.1 so it can parse $/ refs

Merged
JE
2mo ago
+2-2

.github/workflows/dependabot-sync-actions-comments.yml pins zizmor at 1.24.1, which predates the $/.github/workflows/… self-repository uses syntax that #169 introduced. It fails on every input it touches:

ERROR collect_inputs: malformed `uses` ref: missing `@<ref>` in $/.github/workflows/smithy-verify.yml
fatal: no audit was performed

The workflow only runs on dependabot/github_actions/** pushes, so main stays green while every Dependabot Actions PR fails in Sync version comments (e.g. #167 at d807a66). This bumps the pin to 1.30.1 (ZIZMOR_SHA256 re-verified against the zizmor-x86_64-unknown-linux-gnu.tar.gz release asset).

1.30.1 rather than 1.30.0 because 1.30.0 shipped the new self-repository audit with its ./ to $/ rewrite classified as a safe fix, and 1.30.1 reclassified it as unsafe (zizmorcore/zizmor#2373); this workflow runs --fix=safe, so 1.30.0 would rewrite local refs on Dependabot branches.

No other workflow pins a zizmor version: test.yml's audit uses zizmorcore/zizmor-action (SHA-pinned at v0.6.2) with its default version: latest, which already resolves to 1.30.1, so this brings the sync step in line with what the audit already runs.

Checks: actionlint and zizmor 1.30.1 --offline on the changed workflow (no findings), YAML still parses.

Summary by cubic

Bumps the zizmor pin in the version-comment sync workflow to 1.30.1 so it can parse $/.github/workflows/... refs, fixing Dependabot Actions PR failures.

Details

  • The previous pin (1.24.1) errored on $/ self-repository refs, so every Dependabot Actions PR failed in the sync step.
  • Uses 1.30.1 instead of 1.30.0 because 1.30.0 treats the ./ to $/ rewrite as safe; with --fix=safe it would mutate local refs on Dependabot branches.
  • The new ZIZMOR_SHA256 was re-verified against the official release asset.