Skip to content

Add zizmor to workflow templates - #498

Open
maurycy wants to merge 5 commits into
python:mainfrom
maurycy:zizmor-templates
Open

maurycy wants to merge 5 commits into
python:mainfrom
maurycy:zizmor-templates

Conversation

@maurycy

@maurycy maurycy commented Nov 13, 2026 •

Copy link
Copy Markdown
Contributor

Related to #493

Perhaps it should be split. What do you think? There's a lot of changes

2026-11-13T05:57:17.660108000+0100 maurycy@gimel /Users/maurycy/src/github.com/python/bench_runner (main 9ee7dae) % repo=$PWD; tmp=$(mktemp -d) && cd "$tmp" \
    && uv run -q --no-project --with "$repo" python -m bench_runner install \
    && uvx zizmor==1.32.0 --offline .github; cd "$repo"
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/bench_runner.toml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_notify.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/benchmarks.manifest...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/ci.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/README.md...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_find_failures.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_weekly.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/RESULTS.md...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_publish.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/benchmark.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/workflow_bootstrap.src.py...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_pystats.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_generate.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_benchmark.src.yml...
 INFO zizmor: 🌈 zizmor v1.32.0
 INFO audit: zizmor: 🌈 completed .github/workflows/_benchmark.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_find_failures.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_generate.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_notify.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_publish.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_pystats.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_weekly.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/benchmark.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/ci.yml

[...]

140 findings (66 suppressed, 33 unsafe fixes): 0 informational, 13 low, 45 medium, 16 high
2026-11-13T05:57:19.878954000+0100 maurycy@gimel /Users/maurycy/src/github.com/python/bench_runner (main 9ee7dae) % 

Full before:

before
maurycy@gimel bench_runner (macos-openssl3 9c6b42e) % repo=$PWD; tmp=$(mktemp -d) && cd "$tmp" \
    && uv run -q --no-project --with "$repo" python -m bench_runner install \
    && uvx zizmor==1.32.0 --offline .github; cd "$repo"
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/bench_runner.toml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_notify.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/benchmarks.manifest...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/ci.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/README.md...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_find_failures.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_weekly.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/RESULTS.md...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_publish.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/benchmark.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/workflow_bootstrap.src.py...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_pystats.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_generate.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/dp2_mn0JXDmvx1r-/lib/python3.14t/site-packages/bench_runner/templates/_benchmark.src.yml...
 INFO zizmor: 🌈 zizmor v1.32.0
 INFO audit: zizmor: 🌈 completed .github/workflows/_benchmark.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_find_failures.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_generate.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_notify.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_publish.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_pystats.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_weekly.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/benchmark.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/ci.yml
warning[artipacked]: credential persistence through GitHub Actions artifacts
   --> .github/workflows/_benchmark.yml:101:7
    |
101 |       - name: Checkout benchmarking
    |  _______^
102 | |       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
    | |________________________________________________________________________________^ does not set persist-credentials: false
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix

warning[artipacked]: credential persistence through GitHub Actions artifacts
   --> .github/workflows/_benchmark.yml:165:7
    |
165 |       - name: Checkout benchmarking
    |  _______^
166 | |       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
    | |________________________________________________________________________________^ does not set persist-credentials: false
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/_benchmark.yml:3:1
    |
  3 | / name: _benchmark
  4 | |
  5 | | on:
  6 | |   workflow_call:
...   |
197 | |         && 'jit' || '' }},${{ inputs.nogil == true && 'nogil' || '' }},${{ 
198 | |         inputs.tailcall == true && 'tailcall' || '' }}
    | |_______________________________________________________^ default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/_benchmark.yml:93:3
    |
 93 | /   benchmark-linux-x86_64-linux:
 94 | |     runs-on: [self-hosted, linux, bare-metal, linux-x86_64-linux]
 95 | |     timeout-minutes: 1440
...   |
149 | |         && 'jit' || '' }},${{ inputs.nogil == true && 'nogil' || '' }},${{ 
150 | |         inputs.tailcall == true && 'tailcall' || '' }}
    | |                                                      ^
    | |                                                      |
    | |______________________________________________________this job
    |                                                        default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/_benchmark.yml:151:3
    |
151 | /   benchmark-windows-x86_64-windows:
152 | |     runs-on: [self-hosted, windows, bare-metal, windows-x86_64-windows]
153 | |
154 | |     steps:
...   |
197 | |         && 'jit' || '' }},${{ inputs.nogil == true && 'nogil' || '' }},${{ 
198 | |         inputs.tailcall == true && 'tailcall' || '' }}
    | |                                                       ^
    | |                                                       |
    | |_______________________________________________________this job
    |                                                         default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

error[template-injection]: code injection via template expansion
   --> .github/workflows/_benchmark.yml:114:42
    |
113 |       run: |
    |       --- this run block
114 |         python workflow_bootstrap.py ${{ inputs.fork }} ${{ inputs.ref }} ${{ inputs.machine }} ${{ inputs.benchmarks || 'all' }} $...
    |                                          ^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> .github/workflows/_benchmark.yml:114:61
    |
113 |       run: |
    |       --- this run block
114 |         python workflow_bootstrap.py ${{ inputs.fork }} ${{ inputs.ref }} ${{ inputs.machine }} ${{ inputs.benchmarks || 'all' }} $...
    |                                                             ^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> .github/workflows/_benchmark.yml:114:79
    |
113 |       run: |
    |       --- this run block
114 |         python workflow_bootstrap.py ${{ inputs.fork }} ${{ inputs.ref }} ${{ inputs.machine }} ${{ inputs.benchmarks || 'all' }} $...
    |                                                                               ^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> .github/workflows/_benchmark.yml:114:101
    |
113 |       run: |
    |       --- this run block
114 |         python workflow_bootstrap.py ${{ inputs.fork }} ${{ inputs.ref }} ${{ inputs.machine }} ${{ inputs.benchmarks || 'all' }} $...
    |                                                                                                     ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High

error[template-injection]: code injection via template expansion
   --> .github/workflows/_benchmark.yml:172:38
    |
171 |       run: |
    |       --- this run block
172 |         py workflow_bootstrap.py ${{ inputs.fork }} ${{ inputs.ref }} ${{ inputs.machine }} ${{ inputs.benchmarks || 'all' }} "${{ ...
    |                                      ^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> .github/workflows/_benchmark.yml:172:57
    |
171 |       run: |
    |       --- this run block
172 |         py workflow_bootstrap.py ${{ inputs.fork }} ${{ inputs.ref }} ${{ inputs.machine }} ${{ inputs.benchmarks || 'all' }} "${{ ...
    |                                                         ^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> .github/workflows/_benchmark.yml:172:75
    |
171 |       run: |
    |       --- this run block
172 |         py workflow_bootstrap.py ${{ inputs.fork }} ${{ inputs.ref }} ${{ inputs.machine }} ${{ inputs.benchmarks || 'all' }} "${{ ...
    |                                                                           ^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
   --> .github/workflows/_benchmark.yml:172:97
    |
171 |       run: |
    |       --- this run block
172 |         py workflow_bootstrap.py ${{ inputs.fork }} ${{ inputs.ref }} ${{ inputs.machine }} ${{ inputs.benchmarks || 'all' }} "${{ ...
    |                                                                                                 ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → High

warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/_find_failures.yml:14:7
   |
14 |       - name: Checkout benchmarking
   |  _______^
15 | |       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
   | |________________________________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/_find_failures.yml:11:3
   |
11 | /   find_failures:
12 | |     runs-on: ubuntu-latest
13 | |     steps:
14 | |     - name: Checkout benchmarking
...  |
30 | |         add: "['failures.md']"
31 | |         message: Benchmarking failures
   | |                                       ^
   | |                                       |
   | |_______________________________________this job
   |                                         default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/_generate.yml:31:7
   |
31 |       - name: Checkout benchmarking
   |  _______^
32 | |       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
33 | |       with:
34 | |         ref: main
   | |_________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/_generate.yml:28:3
   |
28 | /   generate-results:
29 | |     runs-on: ubuntu-latest
30 | |     steps:
31 | |     - name: Checkout benchmarking
...  |
57 | |           'memory_configs.json']"
58 | |         message: Benchmarking results for @${{ github.actor }}
   | |                                                               ^
   | |                                                               |
   | |_______________________________________________________________this job
   |                                                                 default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

error[template-injection]: code injection via template expansion
  --> .github/workflows/_notify.yml:55:53
   |
55 |       run: python -m bench_runner notify --fork ${{ inputs.fork }} --ref ${{ 
   |       --- this run block                            ^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
  --> .github/workflows/_notify.yml:56:9
   |
55 |       run: python -m bench_runner notify --fork ${{ inputs.fork }} --ref ${{ 
   |       --- this run block
56 |         inputs.ref }} --head ${{ inputs.head }} --date ${{ inputs.date }} 
   |         ^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
  --> .github/workflows/_notify.yml:56:34
   |
55 |       run: python -m bench_runner notify --fork ${{ inputs.fork }} --ref ${{ 
   |       --- this run block
56 |         inputs.ref }} --head ${{ inputs.head }} --date ${{ inputs.date }} 
   |                                  ^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
  --> .github/workflows/_notify.yml:56:60
   |
55 |       run: python -m bench_runner notify --fork ${{ inputs.fork }} --ref ${{ 
   |       --- this run block
56 |         inputs.ref }} --head ${{ inputs.head }} --date ${{ inputs.date }} 
   |                                                            ^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
  --> .github/workflows/_notify.yml:57:23
   |
55 |       run: python -m bench_runner notify --fork ${{ inputs.fork }} --ref ${{ 
   |       --- this run block
56 |         inputs.ref }} --head ${{ inputs.head }} --date ${{ inputs.date }} 
57 |         --version ${{ inputs.version }} --flags ${{ inputs.tier2 == true && 
   |                       ^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/_publish.yml:23:7
   |
23 |       - name: Checkout benchmarking
   |  _______^
24 | |       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
25 | |       with:
26 | |         ref: main
...  |
29 | |         fetch-depth: 20
30 | |         token: ${{ secrets.BENCHMARK_MIRROR }}
   | |______________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/_publish.yml:20:3
   |
20 | /   mirror:
21 | |     runs-on: ubuntu-latest
22 | |     steps:
23 | |     - name: Checkout benchmarking
...  |
33 | |         git remote add public https://github.com/${{ github.repository }}-public
34 | |         git push -f public main
   | |                                ^
   | |                                |
   | |________________________________this job
   |                                  default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/_pystats.yml:79:7
   |
79 |       - name: Checkout benchmarking
   |  _______^
80 | |       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
   | |________________________________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/_pystats.yml:76:3
    |
 76 | /   collect-stats:
 77 | |     runs-on: [self-hosted, linux, cloud]
 78 | |     steps:
 79 | |     - name: Checkout benchmarking
...   |
104 | |         && 'jit' || '' }},${{ inputs.nogil == true && 'nogil' || '' }},${{ 
105 | |         inputs.tailcall == true && 'tailcall' || '' }}
    | |                                                       ^
    | |                                                       |
    | |_______________________________________________________this job
    |                                                         default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

error[template-injection]: code injection via template expansion
  --> .github/workflows/_pystats.yml:90:52
   |
89 |       run: |
   |       --- this run block
90 |         python workflow_bootstrap.py --pystats ${{ inputs.fork }} ${{ inputs.ref }} all ${{ inputs.benchmarks || 'all' }} ${{ inputs...
   |                                                    ^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
  --> .github/workflows/_pystats.yml:90:71
   |
89 |       run: |
   |       --- this run block
90 |         python workflow_bootstrap.py --pystats ${{ inputs.fork }} ${{ inputs.ref }} all ${{ inputs.benchmarks || 'all' }} ${{ inputs...
   |                                                                       ^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

error[template-injection]: code injection via template expansion
  --> .github/workflows/_pystats.yml:90:93
   |
89 |       run: |
   |       --- this run block
90 |         python workflow_bootstrap.py --pystats ${{ inputs.fork }} ${{ inputs.ref }} all ${{ inputs.benchmarks || 'all' }} ${{ inputs...
   |                                                                                             ^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/_weekly.yml:3:1
   |
 3 | / name: _weekly
 4 | |
 5 | | on:
 6 | |   schedule:
...  |
91 | |       tailcall: false
92 | |     secrets: inherit
   | |_____________________^ default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/_weekly.yml:14:3
   |
14 | /   determine_head:
15 | |     runs-on: ubuntu-latest
16 | |     outputs:
17 | |       commit: ${{ steps.head.outputs.commit }}
...  |
29 | |         cd cpython
30 | |         git log -n 1 --format="commit=%H" >> $GITHUB_OUTPUT
   | |                                                           ^
   | |                                                           |
   | |___________________________________________________________this job
   |                                                             default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/_weekly.yml:32:3
   |
32 | /   pystats:
33 | |     uses: ./.github/workflows/_pystats.yml
34 | |     needs: determine_head
35 | |     with:
...  |
39 | |       tier2: false
40 | |     secrets: inherit
   | |                    ^
   | |                    |
   | |____________________this job
   |                      default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/_weekly.yml:42:3
   |
42 | /   pystats-tier2:
43 | |     uses: ./.github/workflows/_pystats.yml
44 | |     needs: determine_head
45 | |     with:
...  |
49 | |       tier2: true
50 | |     secrets: inherit
   | |                    ^
   | |                    |
   | |____________________this job
   |                      default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/_weekly.yml:52:3
   |
52 | /   generate:
53 | |     uses: ./.github/workflows/_generate.yml
54 | |     if: ${{ always() }}
55 | |     with:
56 | |       force: false
57 | |     needs: [pystats, pystats-tier2, weekly-default-linux, weekly-default-windows]
58 | |     secrets: inherit
   | |                    ^
   | |                    |
   | |____________________this job
   |                      default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/_weekly.yml:60:3
   |
60 | /   publish:
61 | |     uses: ./.github/workflows/_publish.yml
62 | |     if: ${{ always() }}
63 | |     needs: [generate]
64 | |     secrets: inherit
   | |                    ^
   | |                    |
   | |____________________this job
   |                      default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/_weekly.yml:65:3
   |
65 | /   weekly-default-linux:
66 | |     uses: ./.github/workflows/_benchmark.yml
67 | |     needs: determine_head
68 | |     with:
...  |
77 | |       tailcall: false
78 | |     secrets: inherit
   | |                    ^
   | |                    |
   | |____________________this job
   |                      default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/_weekly.yml:79:3
   |
79 | /   weekly-default-windows:
80 | |     uses: ./.github/workflows/_benchmark.yml
81 | |     needs: determine_head
82 | |     with:
...  |
91 | |       tailcall: false
92 | |     secrets: inherit
   | |                     ^
   | |                     |
   | |_____________________this job
   |                       default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
  --> .github/workflows/_weekly.yml:33:11
   |
33 |     uses: ./.github/workflows/_pystats.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
40 |     secrets: inherit
   |     ---------------- inherits all parent secrets
   |
   = note: audit confidence → High

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
  --> .github/workflows/_weekly.yml:43:11
   |
43 |     uses: ./.github/workflows/_pystats.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
50 |     secrets: inherit
   |     ---------------- inherits all parent secrets
   |
   = note: audit confidence → High

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
  --> .github/workflows/_weekly.yml:53:11
   |
53 |     uses: ./.github/workflows/_generate.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
58 |     secrets: inherit
   |     ---------------- inherits all parent secrets
   |
   = note: audit confidence → High

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
  --> .github/workflows/_weekly.yml:61:11
   |
61 |     uses: ./.github/workflows/_publish.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
64 |     secrets: inherit
   |     ---------------- inherits all parent secrets
   |
   = note: audit confidence → High

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
  --> .github/workflows/_weekly.yml:66:11
   |
66 |     uses: ./.github/workflows/_benchmark.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
78 |     secrets: inherit
   |     ---------------- inherits all parent secrets
   |
   = note: audit confidence → High

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
  --> .github/workflows/_weekly.yml:80:11
   |
80 |     uses: ./.github/workflows/_benchmark.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
92 |     secrets: inherit
   |     ---------------- inherits all parent secrets
   |
   = note: audit confidence → High

help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:33:11
   |
32 |   pystats:
   |   ------- this job
33 |     uses: ./.github/workflows/_pystats.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:43:11
   |
42 |   pystats-tier2:
   |   ------------- this job
43 |     uses: ./.github/workflows/_pystats.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:53:11
   |
52 |   generate:
   |   -------- this job
53 |     uses: ./.github/workflows/_generate.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:61:11
   |
60 |   publish:
   |   ------- this job
61 |     uses: ./.github/workflows/_publish.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:66:11
   |
65 |   weekly-default-linux:
   |   -------------------- this job
66 |     uses: ./.github/workflows/_benchmark.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:80:11
   |
79 |   weekly-default-windows:
   |   ---------------------- this job
80 |     uses: ./.github/workflows/_benchmark.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/benchmark.yml:3:1
    |
  3 | / name: benchmark
  4 | | run-name: benchmarking ${{ inputs.fork }}/${{ inputs.ref }} on ${{ 
  5 | |   inputs.machine }} ${{ inputs.tier2 == true && 'T2' || '' }} ${{ inputs.jit == 
  6 | |   true && 'JIT' || '' }} ${{ inputs.nogil == true && 'NOGIL' || '' }} ${{ 
...   |
190 | |       tailcall: ${{ inputs.tailcall }}
191 | |     secrets: inherit
    | |_____________________^ default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/benchmark.yml:60:3
   |
60 | /   determine_base:
61 | |     runs-on: ubuntu-latest
62 | |     outputs:
63 | |       head: ${{ steps.base.outputs.head }}
...  |
97 | |         && 'jit' || '' }},${{ inputs.nogil == true && 'nogil' || '' }},${{ 
98 | |         inputs.tailcall == true && 'tailcall' || '' }}
   | |                                                      ^
   | |                                                      |
   | |______________________________________________________this job
   |                                                        default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/benchmark.yml:99:3
    |
 99 | /   head:
100 | |     uses: ./.github/workflows/_benchmark.yml
101 | |     with:
102 | |       fork: ${{ inputs.fork }}
...   |
112 | |       tailcall: ${{ inputs.tailcall }}
113 | |     secrets: inherit
    | |                    ^
    | |                    |
    | |____________________this job
    |                      default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/benchmark.yml:115:3
    |
115 | /   base:
116 | |     uses: ./.github/workflows/_benchmark.yml
117 | |     needs: determine_base
118 | |     if: ${{ needs.determine_base.outputs.need_to_run != 'false' }}
...   |
130 | |       tailcall: ${{ inputs.tailcall }}
131 | |     secrets: inherit
    | |                    ^
    | |                    |
    | |____________________this job
    |                      default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/benchmark.yml:133:3
    |
133 | /   pystats-head:
134 | |     uses: ./.github/workflows/_pystats.yml
135 | |     if: ${{ inputs.pystats }}
136 | |     with:
...   |
144 | |       tailcall: ${{ inputs.tailcall }}
145 | |     secrets: inherit
    | |                    ^
    | |                    |
    | |____________________this job
    |                      default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/benchmark.yml:147:3
    |
147 | /   pystats-base:
148 | |     uses: ./.github/workflows/_pystats.yml
149 | |     needs: determine_base
150 | |     if: ${{ inputs.pystats && needs.determine_base.outputs.need_to_run != 
...   |
160 | |       tailcall: ${{ inputs.tailcall }}
161 | |     secrets: inherit
    | |                    ^
    | |                    |
    | |____________________this job
    |                      default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/benchmark.yml:163:3
    |
163 | /   generate:
164 | |     uses: ./.github/workflows/_generate.yml
165 | |     with:
166 | |       force: false
167 | |     if: ${{ always() }}
168 | |     needs: [head, base, pystats-head, pystats-base]
169 | |     secrets: inherit
    | |                    ^
    | |                    |
    | |____________________this job
    |                      default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/benchmark.yml:171:3
    |
171 | /   publish:
172 | |     uses: ./.github/workflows/_publish.yml
173 | |     if: ${{ always() }}
174 | |     needs: [generate]
175 | |     secrets: inherit
    | |                    ^
    | |                    |
    | |____________________this job
    |                      default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

warning[excessive-permissions]: overly broad permissions
   --> .github/workflows/benchmark.yml:177:3
    |
177 | /   notify:
178 | |     uses: ./.github/workflows/_notify.yml
179 | |     if: ${{ always() }}
180 | |     needs: [publish, determine_base]
...   |
190 | |       tailcall: ${{ inputs.tailcall }}
191 | |     secrets: inherit
    | |                     ^
    | |                     |
    | |_____________________this job
    |                       default permissions used due to no permissions: block
    |
    = note: audit confidence → Medium

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
   --> .github/workflows/benchmark.yml:100:11
    |
100 |     uses: ./.github/workflows/_benchmark.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
113 |     secrets: inherit
    |     ---------------- inherits all parent secrets
    |
    = note: audit confidence → High

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
   --> .github/workflows/benchmark.yml:116:11
    |
116 |     uses: ./.github/workflows/_benchmark.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
131 |     secrets: inherit
    |     ---------------- inherits all parent secrets
    |
    = note: audit confidence → High

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
   --> .github/workflows/benchmark.yml:134:11
    |
134 |     uses: ./.github/workflows/_pystats.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
145 |     secrets: inherit
    |     ---------------- inherits all parent secrets
    |
    = note: audit confidence → High

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
   --> .github/workflows/benchmark.yml:148:11
    |
148 |     uses: ./.github/workflows/_pystats.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
161 |     secrets: inherit
    |     ---------------- inherits all parent secrets
    |
    = note: audit confidence → High

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
   --> .github/workflows/benchmark.yml:164:11
    |
164 |     uses: ./.github/workflows/_generate.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
169 |     secrets: inherit
    |     ---------------- inherits all parent secrets
    |
    = note: audit confidence → High

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
   --> .github/workflows/benchmark.yml:172:11
    |
172 |     uses: ./.github/workflows/_publish.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
175 |     secrets: inherit
    |     ---------------- inherits all parent secrets
    |
    = note: audit confidence → High

warning[secrets-inherit]: secrets unconditionally inherited by called workflow
   --> .github/workflows/benchmark.yml:178:11
    |
178 |     uses: ./.github/workflows/_notify.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this reusable workflow
...
191 |     secrets: inherit
    |     ---------------- inherits all parent secrets
    |
    = note: audit confidence → High

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:100:11
    |
 99 |   head:
    |   ---- this job
100 |     uses: ./.github/workflows/_benchmark.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:116:11
    |
115 |   base:
    |   ---- this job
116 |     uses: ./.github/workflows/_benchmark.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:134:11
    |
133 |   pystats-head:
    |   ------------ this job
134 |     uses: ./.github/workflows/_pystats.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:148:11
    |
147 |   pystats-base:
    |   ------------ this job
148 |     uses: ./.github/workflows/_pystats.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:164:11
    |
163 |   generate:
    |   -------- this job
164 |     uses: ./.github/workflows/_generate.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:172:11
    |
171 |   publish:
    |   ------- this job
172 |     uses: ./.github/workflows/_publish.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:178:11
    |
177 |   notify:
    |   ------ this job
178 |     uses: ./.github/workflows/_notify.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

warning[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/ci.yml:15:7
   |
15 |     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
   |       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

warning[excessive-permissions]: overly broad permissions
  --> .github/workflows/ci.yml:12:3
   |
12 | /   test:
13 | |     runs-on: ubuntu-latest
14 | |     steps:
15 | |     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd   # v6.0.2
...  |
24 | |       run: |
25 | |         python -m bench_runner install --check
   | |                                               ^
   | |                                               |
   | |_______________________________________________this job
   |                                                 default permissions used due to no permissions: block
   |
   = note: audit confidence → Medium

140 findings (66 suppressed, 33 unsafe fixes): 0 informational, 13 low, 45 medium, 16 high
maurycy@gimel bench_runner (macos-openssl3 9c6b42e) % 

After:

after
maurycy@gimel bench_runner-zizmor-templates (zizmor-templates 4404da0) % repo=$PWD; tmp=$(mktemp -d) && cd "$tmp" \
    && uv run -q --no-project --with "$repo" python -m bench_runner install \
    && uvx zizmor==1.32.0 --offline .github; cd "$repo"
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/bench_runner.toml...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/_notify.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/benchmarks.manifest...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/ci.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/README.md...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/_find_failures.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/_weekly.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/RESULTS.md...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/_publish.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/benchmark.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/workflow_bootstrap.src.py...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/_pystats.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/_generate.src.yml...
Processing /Users/maurycy/.cache/uv/archive-v0/raUud2gTPPpKn9w6/lib/python3.14t/site-packages/bench_runner/templates/_benchmark.src.yml...
 INFO zizmor: 🌈 zizmor v1.32.0
 INFO audit: zizmor: 🌈 completed .github/workflows/_benchmark.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_find_failures.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_generate.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_notify.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_publish.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_pystats.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/_weekly.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/benchmark.yml
 INFO audit: zizmor: 🌈 completed .github/workflows/ci.yml
help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:37:11
   |
36 |   pystats:
   |   ------- this job
37 |     uses: ./.github/workflows/_pystats.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:48:11
   |
47 |   pystats-tier2:
   |   ------------- this job
48 |     uses: ./.github/workflows/_pystats.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:59:11
   |
58 |   generate:
   |   -------- this job
59 |     uses: ./.github/workflows/_generate.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:68:11
   |
67 |   publish:
   |   ------- this job
68 |     uses: ./.github/workflows/_publish.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:76:11
   |
75 |   weekly-default-linux:
   |   -------------------- this job
76 |     uses: ./.github/workflows/_benchmark.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
  --> .github/workflows/_weekly.yml:91:11
   |
90 |   weekly-default-windows:
   |   ---------------------- this job
91 |     uses: ./.github/workflows/_benchmark.yml
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:111:11
    |
110 |   head:
    |   ---- this job
111 |     uses: ./.github/workflows/_benchmark.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:128:11
    |
127 |   base:
    |   ---- this job
128 |     uses: ./.github/workflows/_benchmark.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:147:11
    |
146 |   pystats-head:
    |   ------------ this job
147 |     uses: ./.github/workflows/_pystats.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:162:11
    |
161 |   pystats-base:
    |   ------------ this job
162 |     uses: ./.github/workflows/_pystats.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:179:11
    |
178 |   generate:
    |   -------- this job
179 |     uses: ./.github/workflows/_generate.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:188:11
    |
187 |   publish:
    |   ------- this job
188 |     uses: ./.github/workflows/_publish.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

help[self-repository]: use GitHub's dedicated self-repository syntax
   --> .github/workflows/benchmark.yml:197:11
    |
196 |   notify:
    |   ------ this job
197 |     uses: ./.github/workflows/_notify.yml
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ use '$/...' instead of './...'
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix

71 findings (58 suppressed, 13 unsafe fixes): 0 informational, 13 low, 0 medium, 0 high
maurycy@gimel bench_runner-zizmor-templates (zizmor-templates 4404da0) % 

Comment on lines +182 to +189
env:
FORK: ${{ inputs.fork }}
REF: ${{ inputs.ref }}
MACHINE: ${{ inputs.machine }}
BENCHMARKS: ${{ inputs.benchmarks || 'all' }}
FLAGS: ${{ env.flags }}
run: |
python3 workflow_bootstrap.py ${{ inputs.fork }} ${{ inputs.ref }} ${{ inputs.machine }} ${{ inputs.benchmarks || 'all' }} ${{ env.flags }} ${{ inputs.force && '--force' || '' }} ${{ inputs.pgo && '--pgo' || '' }} --run_id ${{ github.run_id }}
python3 workflow_bootstrap.py "$FORK" "$REF" "$MACHINE" "$BENCHMARKS" "$FLAGS" ${{ inputs.force && '--force' || '' }} ${{ inputs.pgo && '--pgo' || '' }} --run_id ${{ github.run_id }}

@maurycy maurycy Nov 13, 2026 •

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is a wow finding to me

contents: read
if: ${{ always() }}
needs: [generate]
secrets: inherit

@maurycy maurycy Nov 13, 2026 •

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This might have implications but I'm not exactly sure.

# Conflicts:
#	bench_runner/templates/_benchmark.src.yml
#	bench_runner/templates/_find_failures.src.yml
#	bench_runner/templates/_pystats.src.yml
#	bench_runner/templates/ci.src.yml
@maurycy maurycy changed the title Fix zizmor findings in workflow templates Add zizmor to workflow templates Nov 13, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant