[dependabot]

Bumps the action-deps group with 1 update: zizmorcore/zizmor-action.

Updates zizmorcore/zizmor-action from 0.7.1 to 0.8.0

Release notes

Sourced from zizmorcore/zizmor-action's releases.

v0.8.0

The action now supports prereleases.

The default has not changed, but you can pass a prerelease version of zizmor or version: prerelease to get whatever latest prerelease the action knows about.

What's Changed

• Support prereleases by @​woodruffw in zizmorcore/zizmor-action#182
• Sync zizmor versions by @​github-actions[bot] in zizmorcore/zizmor-action#184

Full Changelog: zizmorcore/zizmor-action@v0.7.1...v0.8.0

Commits

• 53290ba Sync zizmor versions (#184)
• 76da2ee Support prereleases (#182)
• fb1d87b chore(deps): bump the github-actions group with 2 updates (#180)
• be36601 README: bump pins (#179)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mroderick]

Dependency Upgrade Review

Verdict: Compatible (head e3f932a225759dc5764c13287339a697f45404e4) · Confidence: Medium

The PR bumps the pinned zizmorcore/zizmor-action SHA from v0.7.1 to v0.8.0 in ci.yml's check-workflows job, which is the only usage and it passes no inputs. Upstream changes are additive (a new prerelease version option and sync tooling); the default (latest) path resolves the identical zizmor 1.31.1 pin, and the round-trip probe passes, so the upgrade is safe. One partial gap: the embedded codeql-action SARIF-upload SHA also advanced inside the action and was not line-traced.

Checks

Check	Result
planner suite	pass
auth suite	pass
round-trip probe	pass

Contracts

Contract	Status	Basis
Default version resolution picks the same zizmor (1.31.1) at 0.7.1 and 0.8.0	Verified	Byte-compared support/locks/zizmor-latest.txt at both action SHAs via GitHub API: identical zizmor==1.31.1 pin.
check-workflows job still scans workflows and uploads SARIF to the security tab	Partially verified	Read default-path run and SARIF-upload step in action.yml at the new SHA; the codeql-action v4.38.3 change itself is not line-traced.

Compatibility analysis — 1 package

• zizmorcore/zizmor-action 0.7.1 → 0.8.0: Minor bump; upstream adds a prerelease version option, a zizmor-prerelease lockfile, and a release-sync workflow. The repository invokes the action with no with:, so it takes all defaults; the default path is untouched and resolves the same zizmor pin. One transitive change sits on this repo's path: the embedded codeql-action/upload-sarif pin advanced v4.38.2 → v4.38.3, active because advanced-security defaults to true.

Usage of 1 dependency

• zizmorcore/zizmor-action: .github/workflows/ci.yml: check-workflows job, single uses: with no with: — all inputs at defaults.

Test coverage

• Strong: round-trip probe passed at the new action SHA, covering the action's default-path execution.
• Gap: no repository test exercises .github/workflows/ci.yml; action behavior can only be observed in CI.
• Strong: planner-suite and auth-suite pass, confirming no regression outside the workflow change.

Calibration and confidence

Confidence: Medium — Default-path behavior is verified unchanged by comparing the vendored lockfiles, but the SARIF upload now runs through a codeql-action patch bump that was not line-traced; the confidence cap for partially verified contracts applies.

1. Weakest claim: Assumption that the codeql-action/upload-sarif SHA bump inside the new action ref preserves upload behavior; line-tracing that upload path or one green CI run post-merge would shore it up.
2. Relied on but unverified: I rely on the codeql-action v4.38.2 → v4.38.3 patch bump preserving SARIF upload behavior, and on the prerelease feature being purely additive rather than altering the empty-version default path.
3. Falsifier: The check-workflows job failing after merge — zizmor installation errors, an 'unknown version' die from the changed action.sh, or a SARIF upload failure — would disprove the verdict.