github/penpot
1
0
Fork 0
mirror of https://github.com/penpot/penpot.git synced 2026-10-29 05:50:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

👷 Accept remaining zizmor exceptions

Browse Source 
wrangler stays an ad hoc install in the plugin deploys and the devenv
image keeps its floating tag: both are deliberate, so mark them as
accepted instead of pending.

AI-assisted-by: Claude
Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
This commit is contained in:
David Barragán Merino 2026-10-02 10:47:05 +00:00
parent e65d10017d
commit 61bc585386
1 changed files with 5 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
.github/zizmor.yml vendored
View File

@ -6,9 +6,9 @@
# Remove a file from a list in the same PR that fixes it, and the whole rule
# entry once its list is empty.
rules:
# Pending: wrangler is added with `pnpm add wrangler@latest` before each
# deploy because it is not a dependency of the plugins workspace. Fixed by
# adding it to plugins/package.json (devDependencies) and dropping that line.
# Accepted: wrangler is added with `pnpm add wrangler@latest` before each
# deploy instead of being a dependency of the plugins workspace. Only used
# to publish to Cloudflare; not worth adding to the workspace.
adhoc-packages:
ignore:
- plugins-deploy-api-doc.yml
@ -23,9 +23,8 @@ rules:
# Style nudge towards the `$/...` syntax; not worth enforcing.
self-repository:
disable: true
# Accepted for now: penpotapp/devenv is our own image, built and pushed by
# build-docker-devenv.yml. Pinning it by digest means bumping ten files on
# every rebuild; revisit once Renovate can do that automatically.
# Accepted: penpotapp/devenv is our own image, built and pushed by
# build-docker-devenv.yml, so the floating tag is intentional.
unpinned-images:
ignore:
- plugins-deploy-package.yml