Repository navigation
docs(zizmor): group caller concurrency per event - #105
Open
oc-tmueller wants to merge 2 commits into
Open
oc-tmueller wants to merge 2 commits into
oc-tmueller wants to merge 2 commits into
Conversation
With one concurrency group per ref and cancel-in-progress: true, the documented caller let a push to the default branch cancel the weekly run (and vice versa); even with cancellation limited to pull requests, GitHub keeps one pending run per group, so a queued weekly run could still be displaced. Group per event and cancel only superseded pull request runs. Also correct the acceptance mysql image ignore reason: besides the caller's databases input, the tag can be the fixed mariadb:10.6 federated fallback. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
The federated fallback image was the literal '"mariadb:10.6', an invalid reference: a federated run on a non-MySQL database failed while starting its service containers. Also make the zizmor caller concurrency comment say what GitHub actually guarantees. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com>
LukasHirt
pushed a commit
to owncloud/ocis-php-sdk
that referenced
this pull request
Oct 26, 2026
* ci: add zizmor workflow audit Runs zizmor over this repository's workflows and Dependabot config on every pull request, on pushes to the default branch and weekly, through owncloud/reusable-workflows' zizmor.yml. Any finding fails the check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> * fix(ci): resolve zizmor findings - dependabot-cooldown: composer updates wait 7 days, as github-actions already does elsewhere in the org. - excessive-permissions: ci.yml ran with the repository default, which is read/write. It now defaults to contents: read; only the docs job gets contents: write, for peaceiris/actions-gh-pages pushing the docs and docs-hugo branches. COMPOSER_TOKEN only needs read. - artipacked: checkouts do not persist credentials. The gh-pages pushes authenticate through the action's github_token input, not the checkout's credentials. - ref-version-mismatch: setup-php's tag is 2.40.0, without the v. - cache-poisoning: setup-go (cache: false) and setup-node (package-manager-cache: false) in build-ocis do not cache. The actions/cache steps for composer and the ocis binaries are suppressed inline: they only feed the tests, and the docs job publishes from source without them. - adhoc-packages: suppressed inline, pnpm is version-pinned (9.15.9). - ci.yml now ends with a newline. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> * fix(ci): say what the zizmor concurrency group guarantees GitHub keeps one pending run per concurrency group whatever cancel-in-progress says, so a queued push run can still be replaced by a newer one; only the weekly run is fully protected by the per-event group. Same wording as owncloud/reusable-workflows#105. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --------- Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
LukasHirt
pushed a commit
to owncloud/web-app-skeleton
that referenced
this pull request
Oct 26, 2026
* ci: add zizmor workflow audit Runs zizmor over this repository's workflows and Dependabot config on every pull request, on pushes to the default branch and weekly, through owncloud/reusable-workflows' zizmor.yml. Any finding fails the check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> * fix(ci): resolve zizmor findings - cache-poisoning: the tag-triggered release no longer restores the pnpm cache, which branch and pull request builds write. - excessive-permissions: CI ran with the repository default token, which is read/write; it now grants contents: read. - artipacked: checkouts do not persist credentials; the release publishes through softprops/action-gh-release with its own token. - dependabot-cooldown: npm updates wait 7 days. - superfluous-actions: suppressed inline; the publish step only runs on a real release, so CI cannot exercise a rewrite to gh release. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> * fix(ci): say what the zizmor concurrency group guarantees GitHub keeps one pending run per concurrency group whatever cancel-in-progress says, so a queued push run can still be replaced by a newer one; only the weekly run is fully protected by the per-event group. Same wording as owncloud/reusable-workflows#105. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --------- Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
LukasHirt
pushed a commit
to owncloud/moodle-repository_ocis
that referenced
this pull request
Oct 26, 2026
* ci: add zizmor workflow audit Runs zizmor over this repository's workflows and Dependabot config on every pull request, on pushes to the default branch and weekly, through owncloud/reusable-workflows' zizmor.yml. Any finding fails the check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> * fix(ci): resolve zizmor findings - excessive-permissions: Moodle Plugin CI ran with the repository default token, which is read/write; nothing in it uses the token, so the workflow now grants contents: read. - artipacked: the plugin checkout does not persist credentials. - dependabot-cooldown: composer updates wait 7 days, as github-actions already does. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> * fix(ci): say what the zizmor concurrency group guarantees GitHub keeps one pending run per concurrency group whatever cancel-in-progress says, so a queued push run can still be replaced by a newer one; only the weekly run is fully protected by the per-event group. Same wording as owncloud/reusable-workflows#105. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> --------- Signed-off-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Thomas Müller <323649642+oc-tmueller@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-ups to #104 that came out of the pilot reviews (notes#577, core#41935, ocis#13232).
docs/zizmor.mdcaller snippet: concurrency is now grouped per event (zizmor-${{ github.event_name }}-${{ github.ref }}), and only pull request runs cancel in progress.cancel-in-progress: true, a push to the default branch and the weekly scheduled run cancelled each other.acceptance.yml: the federated fallback image was the literal'"mariadb:10.6', with a stray leading quote and so an invalid reference. A federated run on a non-MySQL database therefore failed while starting its service containers. The quote is gone, and the zizmor ignore reason now also mentions this fixed fallback.🤖 Generated with Claude Code