mirror of
https://github.com/ruby/ruby.git
synced 2026-10-28 16:36:20 +08:00
Hiroshi SHIBATAandClaude Opus 5.5
5e5ba463cc
It reports every `./` reference to a local action, 175 of them on master. The `$/` form it asks for keeps a step from swapping the checked-out actions and makes SHA pinning enforceable, and neither applies here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
37 lines
959 B
YAML
37 lines
959 B
YAML
# Ignore existing findings (baseline)
|
|
# Composite action findings are suppressed inline with # zizmor: ignore
|
|
rules:
|
|
artipacked:
|
|
# These jobs push back to the repo and need persisted credentials.
|
|
ignore:
|
|
- bundled_gems.yml
|
|
- default_gems_list.yml
|
|
- post_push.yml
|
|
- sync_default_gems.yml
|
|
dangerous-triggers:
|
|
ignore:
|
|
- auto_request_review.yml
|
|
- auto_review_pr.yml
|
|
- labeler.yml
|
|
- pr-playground.yml
|
|
dependabot-cooldown:
|
|
ignore:
|
|
- dependabot.yml
|
|
misfeature:
|
|
ignore:
|
|
- mingw.yml
|
|
- tarball-windows.yml
|
|
- windows.yml
|
|
unpinned-images:
|
|
ignore:
|
|
- compilers.yml
|
|
secrets-outside-env:
|
|
# All committers with write access are trusted; no need for environment-scoped secrets.
|
|
disable: true
|
|
self-repository:
|
|
# Local actions come from our own checkout, and SHA pinning is not enforced.
|
|
disable: true
|
|
unpinned-uses:
|
|
ignore:
|
|
- wsl.yml
|