fix: small things by AtomicFS · Pull Request #916 · 9elements/firmware-action

AtomicFS · 2026-07-30T13:11:13Z

Fixes #823

fully migrate to mdbook v0.5, yeeting out mdbook-admonish, mdbook-footnote, and mdbook-pagetoc
convert all admonish blocks in docs/src/**/*.md to native > [!TYPE] syntax
add custom mdBook preprocessor (docs/preprocessors/prefix_include.py) to fix a rendering bug where multi-line {{#include}}s broke out of their admonition box

And the some minor fixes here and there.

github-actions · 2026-07-30T13:15:56Z

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	15	0	0	0.56s
⚠️ ACTION	zizmor	15	341	0	36.12s
✅ BASH	bash-exec	10	0	0	0.02s
✅ BASH	shellcheck	9	0	0	0.09s
✅ BASH	shfmt	9	0	0	0.01s
✅ DOCKERFILE	hadolint	5	0	0	0.26s
✅ EDITORCONFIG	editorconfig-checker	229	0	0	0.19s
✅ GO	revive	31	0	0	37.27s
✅ JSON	jsonlint	14	0	0	0.8s
✅ JSON	prettier	14	0	0	3.95s
✅ JSON	v8r	14	0	0	5.09s
⚠️ MARKDOWN	markdownlint	32	21	0	5.44s
✅ PYTHON	black	21	0	0	2.36s
✅ PYTHON	flake8	21	0	0	1.61s
✅ PYTHON	isort	21	0	0	0.25s
✅ PYTHON	mypy	21	0	0	11.46s
✅ PYTHON	pylint	21	0	0	9.51s
✅ PYTHON	pyright	21	0	0	2.0s
✅ PYTHON	ruff	21	0	0	0.03s
✅ REPOSITORY	betterleaks	yes	no	no	1.12s
✅ REPOSITORY	checkov	yes	no	no	30.32s
✅ REPOSITORY	gitleaks	yes	no	no	4.9s
✅ REPOSITORY	git_diff	yes	no	no	0.01s
✅ REPOSITORY	grype	yes	no	no	106.69s
✅ REPOSITORY	osv-scanner	yes	no	no	21.47s
✅ REPOSITORY	secretlint	yes	no	no	1.62s
✅ REPOSITORY	syft	yes	no	no	5.52s
✅ REPOSITORY	trivy	yes	no	no	21.34s
✅ REPOSITORY	trivy-sbom	yes	no	no	2.96s
✅ REPOSITORY	trufflehog	yes	no	no	9.56s
✅ SPELL	cspell	229	0	0	5.26s
✅ YAML	prettier	36	0	0	2.07s
✅ YAML	v8r	36	0	0	15.69s
✅ YAML	yamllint	36	0	0	1.76s

Detailed Issues

⚠️ MARKDOWN / markdownlint - 21 errors

docs/src/firmware-action/change_detection.md:53 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:51 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:64 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:71 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:95 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:103 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:121 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:148 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:159 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:164 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:170 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:176 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:182 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:188 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/config.md:194 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/get_started/01_repo.md:15 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/get_started/01_repo.md:20 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/get_started/01_repo.md:26 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/offline_usage.md:29 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/troubleshooting.md:24 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]
docs/src/firmware-action/troubleshooting.md:29 error MD048/code-fence-style Code fence style [Expected: tilde; Actual: backtick]

⚠️ ACTION / zizmor - 341 errors

/docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/go-test.yml:171:15
    |
171 |         uses: actions/setup-go@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/go-test.yml:184:15
    |
184 |         uses: actions/upload-artifact@v7
    |               ^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/go-test.yml:45:9
   |
 5 | / on:
 6 | |   pull_request: {}
 7 | |   pull_request_review:
 8 | |     types: ['submitted']
...  |
11 | |     branches: ['main']
12 | |     tags: ['v*']
   | |________________- generally used when publishing artifacts generated at runtime
...
45 |           uses: actions/setup-go@v7
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> .github/workflows/go-test.yml:128:9
    |
  5 | / on:
  6 | |   pull_request: {}
  7 | |   pull_request_review:
  8 | |     types: ['submitted']
...   |
 11 | |     branches: ['main']
 12 | |     tags: ['v*']
    | |________________- generally used when publishing artifacts generated at runtime
...
128 |           uses: actions/setup-go@v7
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> .github/workflows/go-test.yml:171:9
    |
  5 | / on:
  6 | |   pull_request: {}
  7 | |   pull_request_review:
  8 | |     types: ['submitted']
...   |
 11 | |     branches: ['main']
 12 | |     tags: ['v*']
    | |________________- generally used when publishing artifacts generated at runtime
...
171 |           uses: actions/setup-go@v7
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/lint.yml:31:9
   |
31 |         - name: Checkout
   |  _________^
32 | |         uses: actions/checkout@v7
33 | |         with:
34 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/lint.yml:50:9
   |
50 |         - name: Checkout
   |  _________^
51 | |         uses: actions/checkout@v7
52 | |         with:
53 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/lint.yml:69:9
   |
69 |         - name: Checkout
   |  _________^
70 | |         uses: actions/checkout@v7
   | |_________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/lint.yml:85:9
   |
85 |         - name: Checkout
   |  _________^
86 | |         uses: actions/checkout@v7
   | |_________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:32:15
   |
32 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:36:15
   |
36 |         uses: wagoid/commitlint-github-action@v6
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:51:15
   |
51 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:54:15
   |
54 |       - uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:58:15
   |
58 |         uses: oxsecurity/megalinter/flavors/cupcake@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:70:15
   |
70 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:72:15
   |
72 |         uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:77:15
   |
77 |         uses: golangci/golangci-lint-action@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:86:15
   |
86 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:88:15
   |
88 |         uses: goreleaser/goreleaser-action@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/lint.yml:54:9
   |
 5 | / on:
 6 | |   pull_request: {}
 7 | |   pull_request_review:
 8 | |     types: ['submitted']
...  |
11 | |     branches: ['main']
12 | |     tags: ['v*']
   | |________________- generally used when publishing artifacts generated at runtime
...
54 |         - uses: actions/setup-go@v7
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/pytest.yml:41:9
   |
41 |         - name: Checkout
   |  _________^
42 | |         uses: actions/checkout@v7
43 | |         with:
44 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/pytest.yml:65:9
   |
65 |         - name: Checkout
   |  _________^
66 | |         uses: actions/checkout@v7
   | |_________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:27:15
   |
27 |         uses: re-actors/alls-green@release/v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:42:15
   |
42 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:45:15
   |
45 |       - uses: dorny/paths-filter@v4
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:60:15
   |
60 |         uses: arduino/setup-task@v3
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:62:15
   |
62 |         uses: actions/setup-python@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:66:15
   |
66 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release-prepare.yml:19:9
   |
19 |         - name: Checkout
   |  _________^
20 | |         uses: actions/checkout@v7
21 | |         with:
22 | |           fetch-depth: 0
...  |
25 | |       # Automatically determinate the next release version from Conventional Commits since the latest tag
   | |_________________________________________________________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release-prepare.yml:37:59
   |
36 |         run: |
   |         --- this run block
37 |           sed -i -E "s/default: 'v[0-9\.]+'/default: '${{ steps.semver.outputs.next }}'/g" action.yml
   |                                                           ^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:20:15
   |
20 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:28:15
   |
28 |         uses: ietf-tools/semver-action@v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:50:15
   |
50 |         uses: peter-evans/create-pull-request@v8
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:28:9
   |
28 |         - name: Checkout code
   |  _________^
29 | |         uses: actions/checkout@v7
30 | |         with:
31 | |           fetch-depth: 0
32 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:87:9
   |
87 |         - name: Checkout code
   |  _________^
88 | |         uses: actions/checkout@v7
89 | |         with:
90 | |           fetch-depth: 0
91 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release.yml:52:28
   |
51 |         run: |
   |         --- this run block
52 |           NEXT_VERSION=${{ steps.get_version.outputs.version }}
   |                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

info[template-injection]: code injection via template expansion
   --> .github/workflows/release.yml:108:27
    |
 99 |         uses: actions/github-script@v9
    |         ------------------------------ action accepts arbitrary code
...
102 |           script: |
    |           ------ via this input
...
108 |                 ref: "${{ steps.get_version.outputs.version }}",
    |                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → Low
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:29:15
   |
29 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:34:15
   |
34 |         uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:60:15
   |
60 |         uses: goreleaser/goreleaser-action@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:88:15
   |
88 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:99:15
   |
99 |         uses: actions/github-script@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/release.yml:34:9
   |
34 |         uses: actions/setup-go@v7
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
...
60 |         uses: goreleaser/goreleaser-action@v7
   |         ------------------------------------- runtime artifacts usually published here
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

341 findings (121 suppressed, 1 safe fixes, 158 unsafe fixes): 62 informational, 36 low, 4 medium, 118 high

(Truncated to last 20000 characters out of 108023)

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,DOCKERFILE_HADOLINT,EDITORCONFIG_EDITORCONFIG_CHECKER,GO_REVIVE,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

codecov · 2026-07-30T13:40:54Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 53.19%. Comparing base (84b8bce) to head (136ffaf).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #916      +/-   ##
==========================================
- Coverage   53.22%   53.19%   -0.04%     
==========================================
  Files          17       17              
  Lines        1997     2006       +9     
==========================================
+ Hits         1063     1067       +4     
- Misses        841      846       +5     
  Partials       93       93

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

- build docs also on pull requests that change documentation - but do not deploy Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

- is it indirect dependency - and we do not really use any cropto stuff Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

This reverts commits a3622e3 and 13a381d Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

AtomicFS · 2026-08-04T09:01:01Z

This is how it used to look with all the plugins

And this is the new look

It does not look as good IMHO, but at least it is no longer broken and builds.

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

- we have to resort to using custom pre-processor to handle included code in admonition quote blocks - when code is included, it does not pre-pend each included line with any indentation, which is breaking the quote block and causing the content to leak out of the block AI-Generated: true AI-Model: claude-sonnet-5 Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

- some files contain automatically generated content - this marks them as generated, making reviews nicer Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

- allow for small drop in code coverage Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

MDr164

lgtm, I hope I didn't miss anything obvious

github-actions Bot added bugfix Bugfix / fix github_actions Pull requests that update GitHub Actions code module/stitching labels Jul 30, 2026

github-actions Bot added documentation Improvements or additions to documentation python Pull requests that update Python code labels Jul 30, 2026

AtomicFS force-pushed the fix/small-things branch 4 times, most recently from e68a0b7 to 17abc31 Compare July 30, 2026 18:00

github-actions Bot added docker docker related testing Testing related labels Jul 30, 2026

AtomicFS force-pushed the fix/small-things branch from 17abc31 to 2d9f48a Compare July 30, 2026 18:07

AtomicFS marked this pull request as ready for review July 30, 2026 18:07

AtomicFS requested a review from MDr164 as a code owner July 30, 2026 18:07

AtomicFS enabled auto-merge July 30, 2026 18:07

AtomicFS added 7 commits August 4, 2026 09:20

chore(cmd): run formatter

d3857ba

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

ci(docs): build docs also on PR

bc425da

- build docs also on pull requests that change documentation - but do not deploy Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

chore(python): remove no longer needed ignore comments

d42f862

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

ci(lint): ignore GO-2026-5932

798bc48

- is it indirect dependency - and we do not really use any cropto stuff Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

ci(fix): megalinter golang version

c861569

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

docs(fix): remove mdbook pinned versions

b017d6b

This reverts commits a3622e3 and 13a381d Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

ci(lint): fix cspell

a088694

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

AtomicFS force-pushed the fix/small-things branch from 2d9f48a to 2df0819 Compare August 4, 2026 07:21

github-actions Bot added the dependencies Pull requests that update a dependency file label Aug 4, 2026

AtomicFS force-pushed the fix/small-things branch 2 times, most recently from c95edba to b2df98f Compare August 4, 2026 08:56

MDr164 reviewed Aug 4, 2026

View reviewed changes

Comment thread docs/src/firmware-action/get_started/03_json_config.md Outdated

Comment thread docs/preprocessors/prefix_include.py

AtomicFS added 6 commits August 4, 2026 12:17

docs: migrate to mdbook v5

de6d67c

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

docs: remove forgotten reference

0f312d8

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

chore: mark some files as generates

deb9850

- some files contain automatically generated content - this marks them as generated, making reviews nicer Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

ci(lint): ignore indirect python dependencies

1c488dd

Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

chore(lint): add codecov threshold

136ffaf

- allow for small drop in code coverage Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

AtomicFS force-pushed the fix/small-things branch from 3b9d5a7 to 136ffaf Compare August 4, 2026 10:17

MDr164 approved these changes Aug 4, 2026

View reviewed changes

AtomicFS added this pull request to the merge queue Aug 4, 2026

Merged via the queue into main with commit 365daf3 Aug 4, 2026
97 of 98 checks passed

AtomicFS deleted the fix/small-things branch August 4, 2026 10:46

Navigation Menu

Uh oh!

fix: small things - #916

fix: small things#916
AtomicFS merged 13 commits into
mainfrom
fix/small-things

AtomicFS commented Jul 30, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

AtomicFS commented Aug 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

MDr164 left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

AtomicFS commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅⚠️MegaLinter analysis: Success with warnings

Detailed Issues

Notices

Uh oh!

codecov Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

AtomicFS commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

MDr164 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AtomicFS commented Jul 30, 2026 •

edited

Loading

github-actions Bot commented Jul 30, 2026 •

edited

Loading

codecov Bot commented Jul 30, 2026 •

edited

Loading

AtomicFS commented Aug 4, 2026 •

edited

Loading