ci: gate the zizmor lane on any finding

[kyle-sexton]

No related issue: owner-approved hardening requested in session, the ci-runner counterpart of melodic-software/ci-workflows#787; no tracking issue was filed

Summary

The zizmor lane (pr-require-checks → pr-audit-workflows) was advisory. It already reports no findings, so this PR makes it fail on any finding, and ci-status gates on it.

Fix

• Gate: the pr-audit-workflows job now passes fail-on-severity: low. Under zizmor's exit codes that blocks informational findings too. The input exists at the pinned ci-workflows release (v0.50.0, d223a64); no pin changes.
• Comments: the job comments no longer call the lane advisory or annotations-only; they say it gates and uploads no SARIF.
• Findings: none to clear. Unlike ci-workflows#787, this repo had no self-repository, artipacked or dependabot-cooldown findings, so no .github/zizmor.yml and no ignores were added.

Verification

• zizmor --persona=regular --no-online-audits . (1.30.0, the version the pinned pr-audit-workflows.yml downloads), before and after: exit 0, "No findings to report" (1 suppressed). Online audits with a GitHub token: the same.
• The latest main run's Zizmor job also printed "zizmor completed with no findings" (run 39186486780).
• actionlint 1.7.12 from the repo root with .github/actionlint.yaml: exit 0.
• node --test .github/scripts/*.test.cjs: 23 tests, 23 pass (includes the workflow-pin-metadata contract).
• ./scripts/Test-ReleasePins.ps1: "Release and workflow pins are internally consistent."
• go test -race ./...: all packages ok.

Related

• melodic-software/ci-workflows#787

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T14:21:53.392917Z	79e4080	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed 79e4080a21f0efd92d66792d9c467785cebbc4ea: 0 finding(s), 0 as inline comments.

No security issues found in PR #482 at head 79e4080.

The diff touches only .github/workflows/pr-require-checks.yml, in the Zizmor job. It adds fail-on-severity: low to the pr-audit-workflows.yml reusable call and rewords two comments.

• Control strength: the change tightens a gate, since any zizmor finding now fails the lane. It does not remove or soften a control, so the instruction-surface lens does not apply.
• Permissions: permissions: is unchanged, with contents: read and security-events: write. The comment edit only restates that no SARIF is uploaded.
• Pin: the reusable workflow stays pinned to the same SHA, d223a644…, tagged v0.50.0.
• Triggers and expressions: none changed, and no new ${{ }} expressions were introduced.

I did not consult the instruction exception register. This diff deletes and softens no standing instruction, so it was not needed.

[github-actions]

claude-review reviewed 79e4080a21f0efd92d66792d9c467785cebbc4ea: 0 finding(s), 0 as inline comments.

No findings. I read the full diff and the PR context, and the change is small and consistent.

What changed: the pr-audit-workflows (Zizmor) job in .github/workflows/pr-require-checks.yml now passes fail-on-severity: low. Its comments were reworded to say the lane gates and uploads no SARIF.

What I checked:

• ci-status already lists pr-audit-workflows in its needs:, so a failing Zizmor lane does fail ci-status. No extra wiring is needed.
• The reworded comments match the new behavior. Granting security-events: write is still needed, because the reusable declares it and callers can't elevate.
• The path-scoped rule in .claude/rules/pr-body-contract.md is advisory about the PR body. The body has a "No related issue:" line and the Summary, Fix, Verification and Related sections, so it meets that rule. There is no closing issue, so there are no acceptance criteria to check.

What I could not verify:

• I could not fetch the pinned pr-audit-workflows.yml at d223a64 (v0.50.0) from melodic-software/ci-workflows. The sandbox refused the gh api call. So I did not confirm that fail-on-severity exists there, or that low is a valid value. An unknown input on a reusable workflow call makes the whole workflow file invalid, so that is worth confirming. The PR author says the input exists at that pin, and that claim is unverified here.
• I did not run the author's other checks: the zizmor "no findings" runs, actionlint and the tests. Those results are author-claimed.