Bump zizmor from 1.0.0 to 1.1.1

[dependabot]

Bumps zizmor from 1.0.0 to 1.1.1.

Release notes

Sourced from zizmor's releases.

v1.1.1

Fixed

• Fixed a regression where workflows with calls to unpinned reusable workflows would fail to parse (#437)

v1.1.0

This release comes with one new audit (secrets-inherit), plus a slew of bugfixes and internal refactors that unblock future improvements!

Added🔗

• New audit: secrets-inherit detects use of secrets: inherit with reusable workflow calls (#408)

Improved🔗

• The template-injection audit now detects injections in calls to azure/cli and azure/powershell (#421)

Fixed🔗

• The template-injection audit no longer consider github.server_url dangerous (#412)
• The template-injection audit no longer crashes when evaluating the static-ness of an environment for a uses: step (#420)

v1.0.1

This is a small quality and bugfix release. Thank you to everybody who helped by reporting and shaking out bugs from our first stable release!

Improved

• The github-env audit now detects dangerous writes to GITHUB_PATH, is more precise, and can produce multiple findings per run block (#391)

Fixed

• workflow_call.secrets keys with missing values are now parsed correctly (#388)
• The cache-poisoning audit no longer incorrectly treats docker/build-push-action as a publishing workflow is push: false is explicitly set (#389)
• The template-injection audit no longer considers github.action_path to be a potentially dangerous expansion (#402)
• The github-env audit no longer skips run: steps with non-trivial shell: stanzas (#403)

Changelog

Sourced from zizmor's changelog.

v1.1.1

Fixed

• Fixed a regression where workflows with calls to unpinned reusable workflows would fail to parse (#437)

v1.1.0

This release comes with one new audit ([secrets-inherit]), plus a slew of bugfixes and internal refactors that unblock future improvements!

Added

• New audit: [secrets-inherit] detects use of secrets: inherit with reusable workflow calls (#408)

Improved

• The [template-injection] audit now detects injections in calls to @​azure/cli and @​azure/powershell (#421)

Fixed

• The [template-injection] audit no longer consider github.server_url dangerous (#412)
• The [template-injection] audit no longer crashes when evaluating the static-ness of an environment for a uses: step (#420)

v1.0.1

This is a small quality and bugfix release. Thank you to everybody who helped by reporting and shaking out bugs from our first stable release!

Improved

• The [github-env] audit now detects dangerous writes to GITHUB_PATH, is more precise, and can produce multiple findings per run block (#391)

Fixed

• workflow_call.secrets keys with missing values are now parsed correctly (#388)
• The [cache-poisoning] audit no longer incorrectly treats docker/build-push-action as a publishing workflow is push: false is explicitly set (#389)
• The [template-injection] audit no longer considers github.action_path to be a potentially dangerous expansion (#402)
• The [github-env] audit no longer skips run: steps with non-trivial shell: stanzas (#403)

Commits

• ec37d0a chore: prep 1.1.1 (#438)
• 567f8ba chore(deps): bump the cargo group with 4 updates (#434)
• 65a1996 chore(deps): bump the github-actions group with 2 updates (#436)
• 2d1e298 fix: bump github-actions-models (#437)
• c5d0150 docs: bump trophies (#430)
• b178d52 chore: prep 1.1.0 (#428)
• 8d6f684 chore: move tests (#426)
• 572e5d7 refactor: add StepBodyCommon (#425)
• 58ea9e9 refactor: UsesCoordinate -> ActionCoordinate (#424)
• 186a67b chore(docs): bump trophies, add arch install section (#423)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #2365.