feat: decrease sensitivity of concurrency-limits audit (#1303)

crates/zizmor/src/audit/concurrency_limits.rs

@@ -6,7 +6,7 @@ use crate::{
     state::AuditState,
 };
 use anyhow::Result;
-use github_actions_models::{common::expr::BoE, workflow::Concurrency};
+use github_actions_models::workflow::Concurrency;
 
 pub(crate) struct ConcurrencyLimits;
 
@@ -28,29 +28,6 @@ impl Audit for ConcurrencyLimits {
     ) -> Result<Vec<Finding<'doc>>> {
         let mut findings = vec![];
         match &workflow.concurrency {
-            Some(Concurrency::Rich {
-                group: _,
-                cancel_in_progress,
-            }) => {
-                if let BoE::Literal(cancel) = &cancel_in_progress
-                    && !cancel
-                {
-                    findings.push(
-                        Self::finding()
-                            .confidence(Confidence::High)
-                            .severity(Severity::Low)
-                            .persona(Persona::Pedantic)
-                            .add_location(
-                                workflow
-                                    .location()
-                                    .primary()
-                                    .with_keys(["concurrency".into()])
-                                    .annotated("cancel-in-progress set to false"),
-                            )
-                            .build(workflow)?,
-                    );
-                };
-            }
             Some(Concurrency::Bare(_)) => {
                 findings.push(
                     Self::finding()
@@ -82,6 +59,11 @@ impl Audit for ConcurrencyLimits {
                         .build(workflow)?,
                 );
             }
+            // NOTE: Per #1302, we don't nag the user if they've explicitly set
+            // `cancel-in-progress: false` or similar. This is like with the
+            // artipacked audit, where `persist-credentials: true` is seen as
+            // a positive signal of user intent.
+            _ => {}
         }
 
         Ok(findings)

crates/zizmor/tests/integration/snapshot.rs

@@ -1078,6 +1078,7 @@ fn concurrency_limits() -> Result<()> {
     "
     );
 
+    // Note: per #1302, we intentionally don't produce findings here.
     insta::assert_snapshot!(
         zizmor()
             .input(input_under_test(
@@ -1085,19 +1086,7 @@ fn concurrency_limits() -> Result<()> {
             ))
             .args(["--persona=pedantic"])
             .run()?,
-        @r"
-    help[concurrency-limits]: insufficient job-level concurrency limits
-     --> @@INPUT@@:5:1
-      |
-    5 | / concurrency:
-    6 | |   group: ${{ github.workflow }}-${{ github.event.pull_request_number || github.ref }}
-    7 | |   cancel-in-progress: false
-      | |___________________________^ cancel-in-progress set to false
-      |
-      = note: audit confidence → High
-
-    1 finding: 0 informational, 1 low, 0 medium, 0 high
-    "
+        @"No findings to report. Good job!"
     );
 
     insta::assert_snapshot!(

docs/release-notes.md

@@ -9,6 +9,11 @@ of `zizmor`.
 
 ## Next (UNRELEASED)
 
+### Enhancements 🌱
+
+* The [concurrency-limits] audit no longer flags explicit user concurrency
+  overrides, e.g. `cancel-in-progress: false` (#1302)
+
 ## 1.16.1
 
 ### Enhancements 🌱