Review backlog (correctness): zizmor check fails on unrelated pin version-comment drift #466

Activity

1. hivecommons-hive

   added

   from-reviewCreated by Hive for agent-filed issue provenanceCreated by Hive for agent-filed issue provenance

   on Oct 13, 2026
2. castrojo

   added

   triage/acceptedScope accepted; ready for work. Use `/triage accepted`.Scope accepted; ready for work. Use `/triage accepted`.

   on Oct 14, 2026
3. kylerankin commented on Oct 14, 2026

   

   kylerankin

   on Oct 14, 2026

   Contributor

   More actions

   Summary

   This finding is already fixed in the repository. The zizmor security check that was failing now passes on the main branch, so there is no code change left to make here.

   What the finding was

   zizmor is a linter that audits GitHub Actions workflow files for security problems. It was failing on two scheduled workflows — track-binaries.yml and track-junctions.yml — because a shared action (actions/create-github-app-token, which mints a short-lived token so the job can push updates) was pinned to a specific commit while a comment labeled it "v3". That "v3" tag had moved on, so the pinned commit no longer matched the version the comment claimed, and zizmor reports that mismatch as an error. Even though this drift was not caused by the PR the finding came from, zizmor is a required check, so it would have blocked any merge.

   What covers it

   Merged PR #465, "chore(deps): update actions/create-github-app-token digest to 64ab729" (merge commit 59aca8f, on the main branch), updated both affected lines to the current commit that the "v3" tag actually points to.

   • .github/workflows/track-binaries.yml:90
   • .github/workflows/track-junctions.yml:73

   Verification

   The exact linter from the CI workflow (zizmor 1.30.1, the online-audit build) was run against every workflow on the current main branch. Result: "No findings to report." Both previously failing files pass clean, and the pinned commit now matches the v3 tag tip exactly (64ab729a6294000f5aa4a4bc0b73d1f32bc45510).

   Because the merged PR already resolves everything actionable, no new PR is opened here.

   — hive: backend=pi model=lemonade/ornith-1.5-35b-gguf-q6_k

   ---

   🐝 Hive Agent: contributor | SHA: 3772407
4. hivecommons-hive

   added

   hive/already-doneHive contributor found this issue already resolved; remove if work remainsHive contributor found this issue already resolved; remove if work remains

   hive/likely-doneHive verified that a merged PR references or claims this issue; pending confirmationHive verified that a merged PR references or claims this issue; pending confirmation

   on Oct 14, 2026
5. hivecommons-hive commented on Oct 14, 2026

   

   hivecommons-hiveBot

   on Oct 14, 2026 – with hivecommons-hive

   ContributorAuthor

   More actions

   Hive: already resolved by #465 (found by contributor kylerankin); added the hive/already-done label and closing as completed if the issue close gate allows.
6. hivecommons-hive

   closed this as completedon Oct 14, 2026