From 94cc91de658f249a7f65946f87ddf19c870429eb Mon Sep 17 00:00:00 2001 From: kingchenc Date: Mon, 6 Jul 2026 12:18:41 +0200 Subject: [PATCH] ci(zizmor): suppress impostor-commit on the dtolnay/rust-toolchain pin dtolnay/rust-toolchain moved from rolling stable/nightly branches to version tags, so the pinned (still valid, still immutable) SHA is no longer reachable from a branch and zizmor flags it as an impostor-commit. Add the same `# zizmor: ignore[impostor-commit]` marker the shazam/copilot repos already use. Comment-only; the action SHA is unchanged. --- .github/actions/setup-rust/action.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/actions/setup-rust/action.yml b/.github/actions/setup-rust/action.yml index a25b45a2..58f3d6fa 100644 --- a/.github/actions/setup-rust/action.yml +++ b/.github/actions/setup-rust/action.yml @@ -23,7 +23,7 @@ runs: using: composite steps: - id: first - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27 + uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # zizmor: ignore[impostor-commit] pinned to the stable-tag SHA (2026-03-27); tag-pinned, not a branch commit continue-on-error: true with: toolchain: ${{ inputs.toolchain }} @@ -39,7 +39,7 @@ runs: - name: Retry the Rust toolchain install if: steps.first.outcome == 'failure' - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable branch, 2026-03-27 + uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # zizmor: ignore[impostor-commit] pinned to the stable-tag SHA (2026-03-27); tag-pinned, not a branch commit with: toolchain: ${{ inputs.toolchain }} components: ${{ inputs.components }}