[dependabot]

Bumps https://github.com/zizmorcore/zizmor-pre-commit from v1.31.1 to 1.32.0.

Release notes

Sourced from https://github.com/zizmorcore/zizmor-pre-commit's releases.

v1.32.0

Sponsorship is appreciated!

New Features 🌈🔗

• zizmor now has experimental support for GitHub Actions workflow lockfiles. Please see the limitations documentation for more information about the current implementation and its limitations (#2463)

Enhancements 🌱🔗

• zizmor's input collection is now "root-aware" by default, meaning that invocations like zizmor . will no longer collect inputs unless they would actually be used by GitHub Actions, etc. This should eliminate spurious findings from (e.g.) workflow definitions in vendored directories. See the input collection documentation for more information. (#2454)

• zizmor's LSP now honors the didChangeWorkspaceFolders event (#2461)

• zizmor's LSP now audits pre-commit inputs (#2485)

• zizmor now provides Windows ARM64 wheels on PyPI (#2424)

  Many thanks to @​ndabas for proposing and implementing this improvement!

Bug Fixes 🐛🔗

• Fixed a bug where the bot-conditions audit did not properly flag if: condition of jobs that call a reusable workflow (#2457)

• Fixed a bug where the obfuscation audit would incorrectly flag (and suggest an incorrect auto-fix for) expressions that constant-reduce to other expressions (#2483)

• Fixed a bug where the template-injection audit did not flag attacker-controllable contexts wrapped in fromJSON(...), such as fromJSON(toJSON(github.event.issue.title)) (#2495)

• Fixed a bug where the template-injection audit did not flag attacker-controllable contexts in the values of case(...), such as case(cond, github.event.issue.title, 'x') (#2504)

• Fixed a class of bugs in the obfuscation audit where a constant-reducible subexpression would not be replaced with a contextually correct form (#2483)

• Fixed a bug where zizmor would incorrectly audit pre-commit inputs that ended with .yml, despite pre-commit requiring the .yaml suffix (#2485)

• Fixed a bug where zizmor would not honor some ignore comments for the stale-action-refs audit (#2494)

• Fixed a bug where zizmor would not honor some ignore comments for the ref-version-mismatch audit (#2494)

Commits

• 06a3975 Mirror: 1.32.0
• See full diff in compare view

[Copilot]

🟢 Approval recommended

There are no active review issues for the zizmor pre-commit hook version bump.

No open issues 🎉

What changed in this PR

Updates the repository’s zizmor pre-commit hook to include upstream improvements and fixes for GitHub Actions security auditing.

Changes:

• Bumps zizmor-pre-commit from v1.31.1 to v1.32.0, leaving hook configuration unchanged.

File	Description
.pre-commit-config.yaml	Updates the pinned zizmor hook revision to v1.32.0.

_{Review effort: Balanced}

[cloudsmith-bot]

@dependabot rebase