From 8e17eeb88929942c5a29ac7d261dd798600ccbba Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 11:38:13 -0400 Subject: [PATCH 1/5] ci: allow trusted Renovate validator to follow main\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/renovate.yml | 2 +- .github/zizmor.yml | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 665ff11..6eacd35 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -17,4 +17,4 @@ permissions: jobs: validate: - uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@196aa8e3616c99a3f52918306caeaa01923168f3 # main + uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@main \ No newline at end of file diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..0c7381d --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,6 @@ +rules: + unpinned-uses: + config: + policies: + "*": hash-pin + "gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml": ref-pin \ No newline at end of file From 9e33deb7e58c3b62bb4bd12fe21ca8da471cd3d6 Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 11:38:48 -0400 Subject: [PATCH 2/5] ci: document Renovate validator ref-pin exception Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/zizmor.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 0c7381d..ab0b18a 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -3,4 +3,5 @@ rules: config: policies: "*": hash-pin + # Permit a mutable ref only for the trusted shared validator. "gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml": ref-pin \ No newline at end of file From 9ea8248989e80e11d670a0d1bd16af3954d4cb7e Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 11:39:24 -0400 Subject: [PATCH 3/5] ci: normalize YAML file endings Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> From 42cd753e1a15998d9ce75d0a0ad2b7a79ad84d05 Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 11:39:45 -0400 Subject: [PATCH 4/5] ci: preserve YAML trailing newlines Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/renovate.yml | 2 +- .github/zizmor.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 6eacd35..a8c4f72 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -17,4 +17,4 @@ permissions: jobs: validate: - uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@main \ No newline at end of file + uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@main diff --git a/.github/zizmor.yml b/.github/zizmor.yml index ab0b18a..c444343 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -4,4 +4,4 @@ rules: policies: "*": hash-pin # Permit a mutable ref only for the trusted shared validator. - "gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml": ref-pin \ No newline at end of file + "gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml": ref-pin From 976856cccd86086cdcf328d3cc12f3c91afddf5a Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 14:38:24 -0400 Subject: [PATCH 5/5] style: match repository YAML formatting Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/zizmor.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index c444343..c0ab152 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -2,6 +2,6 @@ rules: unpinned-uses: config: policies: - "*": hash-pin + '*': hash-pin # Permit a mutable ref only for the trusted shared validator. - "gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml": ref-pin + gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml: ref-pin