zizmorcore/zizmor-action v0.4.0

on GitHub

This new version of zizmor-action brings two major changes:

• The new fail-on-no-inputs option can be used to control whether
  zizmor-action fails if no inputs were collected by zizmor. The default
  remains true, reflecting the pre-existing behavior.

• The action's use of the official zizmor Docker images is now fully
  hash-checked internally, preventing accidental or malicious modification
  to the images. This also means that subsequent releases of zizmor
  will induce a release of this action, rather than the action always picking
  up the latest version by default.

What's Changed

• docs: extended permissions required for internal repos by @AntoineSebert in #61
• docs: clarify description of "token" to indicate it is only used for online audits by @rmuir in #63
• Hash-check zizmor Docker images by @woodruffw in #68
• Add fail-on-no-inputs option by @woodruffw in #67

New Contributors

• @AntoineSebert made their first contribution in #61
• @rmuir made their first contribution in #63

Full Changelog: v0.3.0...v0.4.0