From 78c443697c007eee405b20e66d3da0cac23b972f Mon Sep 17 00:00:00 2001 From: Diego Rodrigues de Sa e Souza Date: Fri, 17 Jul 2026 02:05:36 -0300 Subject: [PATCH] chore(quality): rebaseline zizmor 169->175 (cycle workflow drift) +6 from v3.8.48/v3.8.49 workflow changes (npm-publish WS1.3 #7092, electron-release, nightly-compat, nightly-release-green, CI restructures incl. #7501). Breakdown vs v3.8.47: +3 unpinned-uses (@vN convention), +2 cache-poisoning (own release-workflow artifact upload/cache -- operator-controlled, not fork-PR exploitable), +1 excessive-permissions (nightly-compat issues perm). No new template-injection/artipacked/dangerous-triggers. Measured zizmor 1.25.2 = 175 on da3a0be69. Unblocks Quality Gates (Extended) for #7329. --- config/quality/quality-baseline.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/config/quality/quality-baseline.json b/config/quality/quality-baseline.json index 3e8cd63fe6..ee2c81c6d3 100644 --- a/config/quality/quality-baseline.json +++ b/config/quality/quality-baseline.json @@ -164,7 +164,8 @@ "dedicatedGate": true }, "zizmorFindings": { - "value": 169, + "value": 175, + "_rebaseline_2026_07_17_v3849_release": "169 -> 175 (+6). Cycle workflow drift (v3.8.48/v3.8.49): npm-publish.yml (new, WS1.3 #7092), electron-release.yml, nightly-compat.yml, nightly-release-green.yml, CI restructures (#7501 full-history base fetch, #7355 main-green, #7202 merge-queue gates, Trunk/Codecov). Breakdown vs v3.8.47: +3 unpinned-uses (@vN convention, deliberate per _scanner_harden_workflows_2026_06_16), +2 cache-poisoning (artifact upload/cache in the OWN electron-release/npm-publish RELEASE workflows -- operator-controlled, not fork-PR exploitable), +1 excessive-permissions (nightly-compat.yml permissions:issues). No new template-injection/artipacked/dangerous-triggers. Measured with zizmor 1.25.2 via `node scripts/check/check-workflows.mjs --ratchet` = 175 on da3a0be69.", "direction": "down", "dedicatedGate": true, "_rebaseline_2026_06_23_fastpath_gates": "155 -> 159 (+4). Two new jobs added to .github/workflows/quality.yml (fast-vitest, fast-unit) to run vitest + the full unit suite on the PR->release fast-path (release-acceleration plan, _tasks/release-bench/v3.8.35/PLANO-IMPLEMENTACAO.md). The +4 are unpinned-uses: actions/checkout@v7 + actions/setup-node@v6 in each of the 2 jobs — the SAME deliberate @vN convention as every other workflow (see _scanner_harden_workflows_2026_06_16). SHA-pinning only these would violate the convention. No new template-injection/artipacked/cache-poisoning. Measured locally via `npm run check:workflows -- --ratchet` = 159.",