docs(lint): cosmetic fixes by AtomicFS · Pull Request #919 · 9elements/firmware-action

AtomicFS · 2026-08-04T11:34:13Z

No description provided.

AI-Generated: true AI-Model: claude-sonnet-5 Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

github-actions · 2026-08-04T11:38:20Z

✅⚠️MegaLinter analysis: Success with warnings

Descriptor	Linter	Files	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	15	0	0	0.48s
⚠️ ACTION	zizmor	15	341	0	32.99s
✅ BASH	bash-exec	10	0	0	0.02s
✅ BASH	shellcheck	9	0	0	0.1s
✅ BASH	shfmt	9	0	0	0.01s
✅ DOCKERFILE	hadolint	5	0	0	0.25s
✅ EDITORCONFIG	editorconfig-checker	229	0	0	0.14s
✅ GO	revive	31	0	0	36.48s
✅ JSON	jsonlint	14	0	0	1.1s
✅ JSON	prettier	14	0	0	1.74s
✅ JSON	v8r	14	0	0	4.3s
✅ MARKDOWN	markdownlint	32	0	0	2.93s
✅ PYTHON	black	21	0	0	2.08s
✅ PYTHON	flake8	21	0	0	1.32s
✅ PYTHON	isort	21	0	0	0.28s
✅ PYTHON	mypy	21	0	0	10.1s
✅ PYTHON	pylint	21	0	0	9.46s
✅ PYTHON	pyright	21	0	0	2.05s
✅ PYTHON	ruff	21	0	0	0.03s
✅ REPOSITORY	betterleaks	yes	no	no	0.82s
✅ REPOSITORY	checkov	yes	no	no	30.35s
✅ REPOSITORY	gitleaks	yes	no	no	8.53s
✅ REPOSITORY	git_diff	yes	no	no	0.01s
✅ REPOSITORY	grype	yes	no	no	107.66s
✅ REPOSITORY	osv-scanner	yes	no	no	21.83s
✅ REPOSITORY	secretlint	yes	no	no	1.58s
✅ REPOSITORY	syft	yes	no	no	13.13s
✅ REPOSITORY	trivy	yes	no	no	20.81s
✅ REPOSITORY	trivy-sbom	yes	no	no	2.68s
✅ REPOSITORY	trufflehog	yes	no	no	6.53s
✅ SPELL	cspell	229	0	0	4.92s
✅ YAML	prettier	36	0	0	3.91s
✅ YAML	v8r	36	0	0	13.82s
✅ YAML	yamllint	36	0	0	1.49s

Detailed Issues

⚠️ ACTION / zizmor - 341 errors

unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/example.yml:56:15
   |
56 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/example.yml:59:15
   |
59 |       - uses: dorny/paths-filter@v4
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/example.yml:82:15
   |
82 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/example.yml:87:15
   |
87 |         uses: ietf-tools/semver-action@v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/example.yml:94:15
   |
94 |         uses: dorny/paths-filter@v4
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:134:15
    |
134 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:137:15
    |
137 |         uses: actions/cache/restore@v6
    |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:147:15
    |
147 |         uses: actions/cache/save@v6
    |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:196:15
    |
196 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:200:15
    |
200 |         uses: actions/cache/restore@v6
    |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:218:15
    |
218 |         uses: actions/cache/save@v6
    |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:268:15
    |
268 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:271:15
    |
271 |         uses: actions/cache/restore@v6
    |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:284:15
    |
284 |         uses: actions/cache/save@v6
    |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:344:15
    |
344 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:347:15
    |
347 |         uses: actions/cache/restore@v6
    |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:357:15
    |
357 |         uses: actions/cache/save@v6
    |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:399:15
    |
399 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:402:15
    |
402 |         uses: actions/cache/restore@v6
    |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:412:15
    |
412 |         uses: actions/cache/save@v6
    |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:454:15
    |
454 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:457:15
    |
457 |         uses: actions/cache/restore@v6
    |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:470:15
    |
470 |         uses: actions/cache/save@v6
    |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:511:15
    |
511 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:523:15
    |
523 |         uses: actions/upload-artifact@v7
    |               ^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:549:15
    |
549 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:562:15
    |
562 |         uses: actions/upload-artifact@v7
    |               ^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:582:15
    |
582 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:613:15
    |
613 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:616:15
    |
616 |         uses: actions/cache/restore@v6
    |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/example.yml:626:15
    |
626 |         uses: actions/cache/save@v6
    |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/go-test.yml:40:9
   |
40 |         - name: Checkout
   |  _________^
41 | |         uses: actions/checkout@v7
42 | |         with:
43 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/go-test.yml:93:9
   |
93 |         - name: Checkout
   |  _________^
94 | |         uses: actions/checkout@v7
95 | |         with:
96 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
   --> .github/workflows/go-test.yml:125:9
    |
125 |         - name: Checkout
    |  _________^
126 | |         uses: actions/checkout@v7
    | |_________________________________^ does not set persist-credentials: false
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
   --> .github/workflows/go-test.yml:168:9
    |
168 |         - name: Checkout
    |  _________^
169 | |         uses: actions/checkout@v7
    | |_________________________________^ does not set persist-credentials: false
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/go-test.yml:28:15
   |
28 |         uses: re-actors/alls-green@release/v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/go-test.yml:41:15
   |
41 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/go-test.yml:45:15
   |
45 |         uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/go-test.yml:49:15
   |
49 |         uses: actions/download-artifact@v8
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/go-test.yml:70:15
   |
70 |         uses: actions/upload-artifact@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/go-test.yml:76:15
   |
76 |         uses: codecov/codecov-action@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/go-test.yml:94:15
   |
94 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/go-test.yml:97:15
   |
97 |       - uses: dorny/paths-filter@v4
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/go-test.yml:126:15
    |
126 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/go-test.yml:128:15
    |
128 |         uses: actions/setup-go@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/go-test.yml:137:15
    |
137 |         uses: actions/cache/restore@v6
    |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/go-test.yml:149:15
    |
149 |         uses: actions/cache/save@v6
    |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/go-test.yml:156:15
    |
156 |         uses: actions/upload-artifact@v7
    |               ^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/go-test.yml:169:15
    |
169 |         uses: actions/checkout@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/go-test.yml:171:15
    |
171 |         uses: actions/setup-go@v7
    |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
   --> .github/workflows/go-test.yml:184:15
    |
184 |         uses: actions/upload-artifact@v7
    |               ^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
    |
    = note: audit confidence → High
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/go-test.yml:45:9
   |
 5 | / on:
 6 | |   pull_request: {}
 7 | |   pull_request_review:
 8 | |     types: ['submitted']
...  |
11 | |     branches: ['main']
12 | |     tags: ['v*']
   | |________________- generally used when publishing artifacts generated at runtime
...
45 |           uses: actions/setup-go@v7
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> .github/workflows/go-test.yml:128:9
    |
  5 | / on:
  6 | |   pull_request: {}
  7 | |   pull_request_review:
  8 | |     types: ['submitted']
...   |
 11 | |     branches: ['main']
 12 | |     tags: ['v*']
    | |________________- generally used when publishing artifacts generated at runtime
...
128 |           uses: actions/setup-go@v7
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
   --> .github/workflows/go-test.yml:171:9
    |
  5 | / on:
  6 | |   pull_request: {}
  7 | |   pull_request_review:
  8 | |     types: ['submitted']
...   |
 11 | |     branches: ['main']
 12 | |     tags: ['v*']
    | |________________- generally used when publishing artifacts generated at runtime
...
171 |           uses: actions/setup-go@v7
    |           ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
    |
    = note: audit confidence → Low
    = note: this finding has an auto-fix
    = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/lint.yml:31:9
   |
31 |         - name: Checkout
   |  _________^
32 | |         uses: actions/checkout@v7
33 | |         with:
34 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/lint.yml:50:9
   |
50 |         - name: Checkout
   |  _________^
51 | |         uses: actions/checkout@v7
52 | |         with:
53 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/lint.yml:69:9
   |
69 |         - name: Checkout
   |  _________^
70 | |         uses: actions/checkout@v7
   | |_________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/lint.yml:85:9
   |
85 |         - name: Checkout
   |  _________^
86 | |         uses: actions/checkout@v7
   | |_________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:32:15
   |
32 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:36:15
   |
36 |         uses: wagoid/commitlint-github-action@v6
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:51:15
   |
51 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:54:15
   |
54 |       - uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:58:15
   |
58 |         uses: oxsecurity/megalinter/flavors/cupcake@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:70:15
   |
70 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:72:15
   |
72 |         uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:77:15
   |
77 |         uses: golangci/golangci-lint-action@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:86:15
   |
86 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/lint.yml:88:15
   |
88 |         uses: goreleaser/goreleaser-action@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/lint.yml:54:9
   |
 5 | / on:
 6 | |   pull_request: {}
 7 | |   pull_request_review:
 8 | |     types: ['submitted']
...  |
11 | |     branches: ['main']
12 | |     tags: ['v*']
   | |________________- generally used when publishing artifacts generated at runtime
...
54 |         - uses: actions/setup-go@v7
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/pytest.yml:41:9
   |
41 |         - name: Checkout
   |  _________^
42 | |         uses: actions/checkout@v7
43 | |         with:
44 | |           fetch-depth: 0
   | |________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/pytest.yml:65:9
   |
65 |         - name: Checkout
   |  _________^
66 | |         uses: actions/checkout@v7
   | |_________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:27:15
   |
27 |         uses: re-actors/alls-green@release/v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:42:15
   |
42 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:45:15
   |
45 |       - uses: dorny/paths-filter@v4
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:60:15
   |
60 |         uses: arduino/setup-task@v3
   |               ^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:62:15
   |
62 |         uses: actions/setup-python@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/pytest.yml:66:15
   |
66 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release-prepare.yml:19:9
   |
19 |         - name: Checkout
   |  _________^
20 | |         uses: actions/checkout@v7
21 | |         with:
22 | |           fetch-depth: 0
...  |
25 | |       # Automatically determinate the next release version from Conventional Commits since the latest tag
   | |_________________________________________________________________________________________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release-prepare.yml:37:59
   |
36 |         run: |
   |         --- this run block
37 |           sed -i -E "s/default: 'v[0-9\.]+'/default: '${{ steps.semver.outputs.next }}'/g" action.yml
   |                                                           ^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:20:15
   |
20 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:28:15
   |
28 |         uses: ietf-tools/semver-action@v1
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release-prepare.yml:50:15
   |
50 |         uses: peter-evans/create-pull-request@v8
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:28:9
   |
28 |         - name: Checkout code
   |  _________^
29 | |         uses: actions/checkout@v7
30 | |         with:
31 | |           fetch-depth: 0
32 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

help[artipacked]: credential persistence through GitHub Actions artifacts
  --> .github/workflows/release.yml:87:9
   |
87 |         - name: Checkout code
   |  _________^
88 | |         uses: actions/checkout@v7
89 | |         with:
90 | |           fetch-depth: 0
91 | |           fetch-tags: true
   | |__________________________^ does not set persist-credentials: false
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#artipacked

info[template-injection]: code injection via template expansion
  --> .github/workflows/release.yml:52:28
   |
51 |         run: |
   |         --- this run block
52 |           NEXT_VERSION=${{ steps.get_version.outputs.version }}
   |                            ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

info[template-injection]: code injection via template expansion
   --> .github/workflows/release.yml:108:27
    |
 99 |         uses: actions/github-script@v9
    |         ------------------------------ action accepts arbitrary code
...
102 |           script: |
    |           ------ via this input
...
108 |                 ref: "${{ steps.get_version.outputs.version }}",
    |                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
    |
    = note: audit confidence → Low
    = help: audit documentation → https://docs.zizmor.sh/audits/#template-injection

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:29:15
   |
29 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:34:15
   |
34 |         uses: actions/setup-go@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:60:15
   |
60 |         uses: goreleaser/goreleaser-action@v7
   |               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:88:15
   |
88 |         uses: actions/checkout@v7
   |               ^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[unpinned-uses]: unpinned action reference
  --> .github/workflows/release.yml:99:15
   |
99 |         uses: actions/github-script@v9
   |               ^^^^^^^^^^^^^^^^^^^^^^^^ action is not pinned to a hash (required by blanket policy)
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#unpinned-uses

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> .github/workflows/release.yml:34:9
   |
34 |         uses: actions/setup-go@v7
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^ enables caching by default
...
60 |         uses: goreleaser/goreleaser-action@v7
   |         ------------------------------------- runtime artifacts usually published here
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix
   = help: audit documentation → https://docs.zizmor.sh/audits/#cache-poisoning

341 findings (121 suppressed, 1 safe fixes, 158 unsafe fixes): 62 informational, 36 low, 4 medium, 118 high

(Truncated to last 40000 characters out of 108023)

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

Documentation: Custom Flavors
Command: npx mega-linter-runner@9.6.0 --custom-flavor-setup --custom-flavor-linters PYTHON_PYLINT,PYTHON_BLACK,PYTHON_FLAKE8,PYTHON_ISORT,PYTHON_MYPY,PYTHON_PYRIGHT,PYTHON_RUFF,ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,DOCKERFILE_HADOLINT,EDITORCONFIG_EDITORCONFIG_CHECKER,GO_REVIVE,JSON_JSONLINT,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_BETTERLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_CSPELL,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

Show us your support by starring ⭐ the repository

docs(lint): cosmetic fixes

2010d13

AI-Generated: true AI-Model: claude-sonnet-5 Signed-off-by: AtomicFS <vojtech.vesely@9elements.com>

github-actions Bot added documentation Improvements or additions to documentation bugfix Bugfix / fix labels Aug 4, 2026

AtomicFS marked this pull request as ready for review August 4, 2026 11:41

AtomicFS requested a review from MDr164 as a code owner August 4, 2026 11:41

AtomicFS merged commit 7f614f2 into main Aug 4, 2026
36 checks passed

AtomicFS deleted the fix/linting branch August 4, 2026 11:41

Navigation Menu

Uh oh!

docs(lint): cosmetic fixes - #919

docs(lint): cosmetic fixes#919
AtomicFS merged 1 commit into
mainfrom
fix/linting

AtomicFS commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

AtomicFS commented Aug 4, 2026

Uh oh!

github-actions Bot commented Aug 4, 2026

✅⚠️MegaLinter analysis: Success with warnings

Detailed Issues

Notices

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant