Browse Source

fix(ci): zizmor no-op blocks gates (#6889)

Without this, when a commit is tested multiple times, it is not tested
again.

As we require to test for merging (rightfully so), the CI will be
blocked when the commit is tested multiple times.

Creating another commit should fix it.
For me, the noop job was an optimization that lead to this kind
of failures.

Unless zizmor rate limits us, there is no reason to _NOT TEST_
the last commit of a PR, even if it was tested before.
So I removed the noop handling and I am now closer to the
upstream recommendations.

There are indeed other ways to fix it, like keeping the noop
but always run on last commit. But this seems convoluted compared
to simply remove the noop check.

Signed-off-by: Jean-Philippe Evrard <jean-philippe.evrard+rochepub@external.roche.com>
Jean-Philippe Evrard 2 weeks ago
parent
commit
e5d96d674c
1 changed files with 4 additions and 22 deletions
  1. 4 22
      .github/workflows/zizmor.yml

+ 4 - 22
.github/workflows/zizmor.yml

@@ -10,34 +10,16 @@ permissions:
   contents: read
   contents: read
 
 
 jobs:
 jobs:
-  detect-noop:
-    permissions:
-      actions: write  # for fkirc/skip-duplicate-actions to skip or stop workflow runs
-      contents: read  # for fkirc/skip-duplicate-actions to read and compare commits
-    runs-on: ubuntu-latest
-    outputs:
-      noop: ${{ steps.noop.outputs.should_skip }}
-    steps:
-      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
-        with:
-          egress-policy: audit
-      - name: Detect No-op Changes
-        id: noop
-        uses: fkirc/skip-duplicate-actions@b974a9395958c231af965b70070979a577efa578 # v5.3.2
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          paths_ignore: '["**.md", "**.png", "**.jpg"]'
-          do_not_skip: '["workflow_dispatch", "schedule", "push"]'
-          concurrent_skipping: false
-
   zizmor:
   zizmor:
     name: Run zizmor 🌈
     name: Run zizmor 🌈
     runs-on: ubuntu-latest
     runs-on: ubuntu-latest
-    needs: detect-noop
-    if: needs.detect-noop.outputs.noop != 'true'
     permissions:
     permissions:
       security-events: write
       security-events: write
     steps:
     steps:
+      - uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
       - name: Checkout repository
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
         with: