support repositories override by marcoieni · Pull Request #73 · rust-lang/crabwatch

marcoieni · 2026-09-29T07:52:02Z

We can't enable certain zizmor lints because some repositories don't pass them. In this PR, I add a mechanism to disable linters on certain repositories.

In this way, a repository doesn't block lints to be adopted in the organization.

Also enable archived-uses as an example of lint that is disabled on a repository level.

Design decisions

use yq also in the rust code to stress the same code of the crabwatch workflows (and avoid depending on a yaml crate)

Manual test

set repositories: {} in the configuration and run GITHUB_TOKEN=$(gh auth token) cargo run -- analyze --org rust-lang. You will see the following error:

Error


=== rust-lang/chalk ===
 INFO zizmor: 🌈 zizmor v1.30.1
 INFO audit: zizmor: 🌈 completed /Users/marco/Library/Caches/crabwatch/repos/rust-lang/chalk/627409a4735b8eeb9457583515d203013a59211b/.github/workflows/ci.yml
 INFO audit: zizmor: 🌈 completed /Users/marco/Library/Caches/crabwatch/repos/rust-lang/chalk/627409a4735b8eeb9457583515d203013a59211b/.github/workflows/publish.yml
warning[archived-uses]: action or reusable workflow from archived repository
  --> /Users/marco/Library/Caches/crabwatch/repos/rust-lang/chalk/627409a4735b8eeb9457583515d203013a59211b/.github/workflows/ci.yml:21:15
   |
20 |       - name: Install Rust toolchain
   |         ---------------------------- this step
21 |         uses: actions-rs/toolchain@v1
   |               ^^^^^^^^^^^^^^^^^^^^ repository is archived
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#archived-uses

warning[archived-uses]: action or reusable workflow from archived repository
  --> /Users/marco/Library/Caches/crabwatch/repos/rust-lang/chalk/627409a4735b8eeb9457583515d203013a59211b/.github/workflows/ci.yml:75:15
   |
74 |       - name: Install Rust toolchain
   |         ---------------------------- this step
75 |         uses: actions-rs/toolchain@v1
   |               ^^^^^^^^^^^^^^^^^^^^ repository is archived
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#archived-uses

warning[archived-uses]: action or reusable workflow from archived repository
  --> /Users/marco/Library/Caches/crabwatch/repos/rust-lang/chalk/627409a4735b8eeb9457583515d203013a59211b/.github/workflows/publish.yml:20:15
   |
19 |       - name: Install Rust toolchain
   |         ---------------------------- this step
20 |         uses: actions-rs/toolchain@v1
   |               ^^^^^^^^^^^^^^^^^^^^ repository is archived
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#archived-uses

warning[archived-uses]: action or reusable workflow from archived repository
  --> /Users/marco/Library/Caches/crabwatch/repos/rust-lang/chalk/627409a4735b8eeb9457583515d203013a59211b/.github/workflows/publish.yml:27:15
   |
26 |       - name: Install cargo-workspaces
   |         ------------------------------ this step
27 |         uses: actions-rs/install@v0.1
   |               ^^^^^^^^^^^^^^^^^^ repository is archived
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#archived-uses

4 findings: 0 informational, 0 low, 4 medium, 0 high

AI disclosure

I used GPT6-Astra and Fable 5.1 to generate this change. I reviewed its output and changed it where necessary.

marcoieni · 2026-09-29T08:08:52Z

I'm not sure if "zizmor-policy" is a good name.
For example, I think zizmor-config is confusing, because this now is a custom config we have.

An alternative solution would be keep zizmor-default.yml and put the overrides in a different files.

zizmor-policy sounds good to me. Wouldn't splitting it mean the workflow and CLI have to merge two files?

marcoieni · 2026-09-29T08:09:32Z

+    archived-uses:
+      disable: false


it was disabled before 😎

marcoieni · 2026-09-29T08:20:19Z

+  rust-lang/chalk:
+    rules:
+      archived-uses:
+        disable: true


see rust-lang/chalk#834. It doesn't make sense to work on that PR because that repo is unused at the moment

It totally makes sense. Should I go ahead and close rust-lang/chalk#834 then? Chalk also has the adhoc-packages finding in publish.yml, so I guess the same applies there. I can add it to this override when I open the PR for #48.

Great to know this approach resonates with you! Yes I think you can close that PR 👍

ubiratansoares

Added a few comments

ubiratansoares · 2026-09-29T19:32:04Z

+    fn effective_config(&self, repository: &str) -> anyhow::Result<String> {
+        yq(&[BUILD_CONFIG_EXPR], self.file.path(), repository)
+    }
+
+    /// Write `repository`'s zizmor configuration to a temporary file that is
+    /// deleted on drop.
+    ///
+    /// `repository` is GitHub's canonical `owner/name`; override lookup is
+    /// case-sensitive.
+    pub(crate) fn write_config(&self, repository: &str) -> anyhow::Result<NamedTempFile> {
+        temp_file(&self.effective_config(repository)?)
+    }


Should we go async here? If I did not miss anything, yq will block Tokio workers since it's running with std::process::Command

ubiratansoares · 2026-09-29T19:42:48Z

+          echo "::group::Effective zizmor configuration for $GITHUB_REPOSITORY"
+          cat crabwatch-zizmor.yml
+          echo "::endgroup::"


Since clicking the status check

leads to a job summary, perhaps we could write this (also?) to the job summary, so developers see the config without having to expanding the logs.

If useful we could do this in another PR 👍

ubiratansoares · 2026-09-29T19:51:52Z

      - name: Run tests
-        run: cargo test --workspace
+        run: |
+          # The config tests shell out to yq; fail early if the runner image drops it.


I was not aware that yq comes pre-installed on GH runners. It seems it's been around since 2021, at this point feels unlike they will drop it from runner images

I reverted this change.

marcoieni force-pushed the support-repositories-override branch from 24b3b1b to 68d6af8 Compare September 29, 2026 08:01

marcoieni commented Sep 29, 2026

View reviewed changes

marcoieni force-pushed the support-repositories-override branch from 68d6af8 to 9440865 Compare September 29, 2026 08:15

marcoieni commented Sep 29, 2026

View reviewed changes

marcoieni force-pushed the support-repositories-override branch 12 times, most recently from c511426 to 77a7f9c Compare September 29, 2026 15:12

marcoieni marked this pull request as ready for review September 29, 2026 15:14

ubiratansoares reviewed Sep 29, 2026

View reviewed changes

support repositories override

a8562da

marcoieni force-pushed the support-repositories-override branch from 759fd95 to a8562da Compare September 30, 2026 06:24

marcoieni requested a review from ubiratansoares September 30, 2026 06:25

ubiratansoares approved these changes Sep 30, 2026

View reviewed changes

marcoieni merged commit dfa5963 into main Sep 30, 2026
5 checks passed

marcoieni mentioned this pull request Sep 30, 2026

Solve the archived-uses lint #49

Closed

Navigation Menu

support repositories override - #73

support repositories override#73
marcoieni merged 1 commit into
mainfrom
support-repositories-override

marcoieni commented Sep 29, 2026 •

edited

Loading

Uh oh!

marcoieni Sep 29, 2026

Uh oh!

Sandijigs Sep 29, 2026

Uh oh!

marcoieni Sep 29, 2026

Uh oh!

marcoieni Sep 29, 2026

Uh oh!

Sandijigs Sep 29, 2026

Uh oh!

marcoieni Sep 29, 2026

Uh oh!

ubiratansoares left a comment

Uh oh!

ubiratansoares Sep 29, 2026

Uh oh!

marcoieni Sep 30, 2026

Uh oh!

ubiratansoares Sep 29, 2026

Uh oh!

marcoieni Sep 30, 2026

Uh oh!

ubiratansoares Sep 29, 2026

Uh oh!

marcoieni Sep 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

marcoieni commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Design decisions

Manual test

AI disclosure

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ubiratansoares left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

marcoieni commented Sep 29, 2026 •

edited

Loading