diff --git a/crates/zizmor/src/audit/concurrency_limits.rs b/crates/zizmor/src/audit/concurrency_limits.rs index 8733dfd7..adba72f4 100644 --- a/crates/zizmor/src/audit/concurrency_limits.rs +++ b/crates/zizmor/src/audit/concurrency_limits.rs @@ -6,7 +6,7 @@ use crate::{ state::AuditState, }; use anyhow::Result; -use github_actions_models::{common::expr::BoE, workflow::Concurrency}; +use github_actions_models::workflow::Concurrency; pub(crate) struct ConcurrencyLimits; @@ -28,29 +28,6 @@ impl Audit for ConcurrencyLimits { ) -> Result>> { let mut findings = vec![]; match &workflow.concurrency { - Some(Concurrency::Rich { - group: _, - cancel_in_progress, - }) => { - if let BoE::Literal(cancel) = &cancel_in_progress - && !cancel - { - findings.push( - Self::finding() - .confidence(Confidence::High) - .severity(Severity::Low) - .persona(Persona::Pedantic) - .add_location( - workflow - .location() - .primary() - .with_keys(["concurrency".into()]) - .annotated("cancel-in-progress set to false"), - ) - .build(workflow)?, - ); - }; - } Some(Concurrency::Bare(_)) => { findings.push( Self::finding() @@ -82,6 +59,11 @@ impl Audit for ConcurrencyLimits { .build(workflow)?, ); } + // NOTE: Per #1302, we don't nag the user if they've explicitly set + // `cancel-in-progress: false` or similar. This is like with the + // artipacked audit, where `persist-credentials: true` is seen as + // a positive signal of user intent. + _ => {} } Ok(findings) diff --git a/crates/zizmor/tests/integration/snapshot.rs b/crates/zizmor/tests/integration/snapshot.rs index 5fa384c9..15f1c34b 100644 --- a/crates/zizmor/tests/integration/snapshot.rs +++ b/crates/zizmor/tests/integration/snapshot.rs @@ -1078,6 +1078,7 @@ fn concurrency_limits() -> Result<()> { " ); + // Note: per #1302, we intentionally don't produce findings here. insta::assert_snapshot!( zizmor() .input(input_under_test( @@ -1085,19 +1086,7 @@ fn concurrency_limits() -> Result<()> { )) .args(["--persona=pedantic"]) .run()?, - @r" - help[concurrency-limits]: insufficient job-level concurrency limits - --> @@INPUT@@:5:1 - | - 5 | / concurrency: - 6 | | group: ${{ github.workflow }}-${{ github.event.pull_request_number || github.ref }} - 7 | | cancel-in-progress: false - | |___________________________^ cancel-in-progress set to false - | - = note: audit confidence → High - - 1 finding: 0 informational, 1 low, 0 medium, 0 high - " + @"No findings to report. Good job!" ); insta::assert_snapshot!( diff --git a/docs/release-notes.md b/docs/release-notes.md index 1dd40cb3..be5ba95c 100644 --- a/docs/release-notes.md +++ b/docs/release-notes.md @@ -9,6 +9,11 @@ of `zizmor`. ## Next (UNRELEASED) +### Enhancements 🌱 + +* The [concurrency-limits] audit no longer flags explicit user concurrency + overrides, e.g. `cancel-in-progress: false` (#1302) + ## 1.16.1 ### Enhancements 🌱