From 61bc5853864ab2470c3ad7227e8dcc43cac1ba09 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?David=20Barrag=C3=A1n=20Merino?= Date: Fri, 2 Oct 2026 10:47:05 +0000 Subject: [PATCH] :construction_worker: Accept remaining zizmor exceptions MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit wrangler stays an ad hoc install in the plugin deploys and the devenv image keeps its floating tag: both are deliberate, so mark them as accepted instead of pending. AI-assisted-by: Claude Signed-off-by: David Barragán Merino --- .github/zizmor.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index f86f018b5d..8f6e7f112d 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -6,9 +6,9 @@ # Remove a file from a list in the same PR that fixes it, and the whole rule # entry once its list is empty. rules: - # Pending: wrangler is added with `pnpm add wrangler@latest` before each - # deploy because it is not a dependency of the plugins workspace. Fixed by - # adding it to plugins/package.json (devDependencies) and dropping that line. + # Accepted: wrangler is added with `pnpm add wrangler@latest` before each + # deploy instead of being a dependency of the plugins workspace. Only used + # to publish to Cloudflare; not worth adding to the workspace. adhoc-packages: ignore: - plugins-deploy-api-doc.yml @@ -23,9 +23,8 @@ rules: # Style nudge towards the `$/...` syntax; not worth enforcing. self-repository: disable: true - # Accepted for now: penpotapp/devenv is our own image, built and pushed by - # build-docker-devenv.yml. Pinning it by digest means bumping ten files on - # every rebuild; revisit once Renovate can do that automatically. + # Accepted: penpotapp/devenv is our own image, built and pushed by + # build-docker-devenv.yml, so the floating tag is intentional. unpinned-images: ignore: - plugins-deploy-package.yml