Fix zizmor 1.29 finding path parsing by Copilot · Pull Request #58339 · github/gh-aw

Copilot · 2026-09-04T00:44:16Z

Zizmor 1.29 findings were discarded because its JSON output uses verbatim_path instead of given_path. Strict-mode compilation consequently failed with the misleading message zizmor found 0 security warnings/errors.

Changes

Current schema support
- Parse locations[].symbolic.key.Local.verbatim_path.
- Preserve compatibility with legacy given_path output.
Regression coverage
- Cover zizmor 1.29 output and verify findings retain their file location, severity, and message.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

github-actions · 2026-09-04T00:48:51Z

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

github-actions · 2026-09-04T00:48:53Z

❌ Ponytail Reviewer failed. Please review the logs for details.

Warning

Threat Detection Engine Failure — The analysis engine could not complete. This is a tooling failure, not a security finding.

What happened

The threat detection engine failed to produce results.

Review the workflow run logs for details.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

ab.chatgpt.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "ab.chatgpt.com"

See Network Configuration for more information.

Generated by Ponytail Reviewer for #58339

github-actions · 2026-09-04T00:48:55Z

✅ PR Code Quality Reviewer completed the code quality review.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer

github-actions · 2026-09-04T00:48:58Z

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel skipped because pre-fetch PR data was unavailable: unable to fetch test file diff

🧪 Test quality analysis by Test Quality Sentinel

github-actions · 2026-09-04T00:49:01Z

✅ Design Decision Gate 🏗️ completed the design decision gate check. See the comment below for the result and any generated ADR draft.

No ADR enforcement needed: PR does not have the 'implementation' label and has ≤100 new lines of code in business logic directories.

🏗️ ADR gate enforced by Design Decision Gate 🏗️

github-actions

Skills-Based Review 🧠

Applied /diagnosing-bugs — approving, no actionable issues found.

📋 Key Themes & Highlights

Root cause analysis

Correctly identifies the actual root cause: zizmor 1.29 renamed given_path to verbatim_path in its JSON schema, not a transient parsing bug.
Fix falls back to verbatim_path only when given_path is empty, preserving backward compatibility with older zizmor output — good defensive sequencing.

Regression coverage

New test case (current zizmor output uses verbatim path) uses realistic zizmor 1.29 JSON shape and asserts the full formatted output line (path, line, column, severity, message), which would have caught this exact regression.
Existing given_path-based test cases remain untouched, confirming legacy compatibility isn't broken.

Positive Highlights

✅ Minimal, surgical diff (5 lines in the fix, 38 in tests) — no unrelated changes.
✅ Single usage site was updated consistently; no other GivenPath references were missed.

No blocking issues. Small, well-tested fix.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 18 AIC · ⌖ 14.5 AIC · ⊞ 10.3K
_{Comment /matt to run again}

github-actions · 2026-09-04T00:54:14Z

Comment Memory

reviewed_at: 2026-09-04T00:50:38Z
review_event: COMMENT
top_themes:
  - no blocking issues found in zizmor path fallback
files_reviewed:
  - pkg/cli/zizmor.go
  - pkg/cli/zizmor_test.go
comment_count: 0

Note

This comment is managed by comment memory.

It stores persistent context for this thread in the code block at the top of this comment.
Edit only the text inside the backtick fences; workflow metadata and the footer are regenerated automatically.

Learn more about comment memory

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 22.8 AIC · ⌖ 8.57 AIC · ⊞ 21.8K · ◷
_{Comment /review to run again}

github-actions

Verdict

No blocking issues in this patch.

What I checked

The verbatim_path fallback is scoped to the same JSON field family as the legacy given_path, and the added regression test covers the current zizmor 1.29 payload shape that was dropping findings. I did not find a changed-line correctness or maintainability problem worth blocking this PR on.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

🔎 Code quality review by PR Code Quality Reviewer · copilot · gpt54 · 22.8 AIC · ⌖ 8.57 AIC · ⊞ 21.8K
_{Comment /review to run again}

Copilot

🟢 Approval recommended

All reviewed changes are covered by regression tests with no unresolved issues.

Pull request overview

Updates zizmor JSON path parsing for v1.29 while preserving legacy compatibility.

Changes:

Supports verbatim_path with a given_path fallback.
Adds regression coverage for finding details.

File summaries

File	Description
`pkg/cli/zizmor.go`	Parses current and legacy path fields.
`pkg/cli/zizmor_test.go`	Tests zizmor v1.29 output handling.

Review details

Files reviewed: 2/2 changed files
Comments generated: 0
Review effort level: Balanced

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

github-actions · 2026-09-04T01:16:10Z

Great work! 🎉 This fix for zizmor 1.29 finding path parsing looks solid. The PR correctly addresses the JSON output schema change (verbatim_path vs given_path) and maintains backward compatibility with legacy output. The regression test coverage ensures this won't break in the future. This is ready for review!

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

github.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "github.com"

See Network Configuration for more information.

Generated by ✅ Contribution Check · copilot · auto · 53.2 AIC · ⌖ 6.63 AIC · ⊞ 9.3K · ◷

github-actions · 2026-09-04T06:26:51Z

🎉 This pull request is included in a new release.

Release: v0.88.4

Fix zizmor 1.29 finding path parsing

4f72b5e

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI assigned Copilot and pelikhan Sep 4, 2026

Copilot finished work on behalf of pelikhan September 4, 2026 00:44

Copilot created this pull request from a session on behalf of pelikhan September 4, 2026 00:44 View session

Copilot AI requested a review from pelikhan September 4, 2026 00:44

pelikhan marked this pull request as ready for review September 4, 2026 00:47

Copilot AI balanced review requested due to automatic review settings September 4, 2026 00:47

Copilot started reviewing on behalf of pelikhan September 4, 2026 00:47 View session

github-actions Bot approved these changes Sep 4, 2026

View reviewed changes

github-actions Bot mentioned this pull request Sep 4, 2026

[aw] Impeccable Skills Reviewer produced no safe outputs #58316

Closed

github-actions Bot reviewed Sep 4, 2026

View reviewed changes

github-actions Bot added the needs-review label Sep 4, 2026

Copilot AI reviewed Sep 4, 2026

View reviewed changes

github-actions Bot mentioned this pull request Sep 4, 2026

[Contribution Check Report] Contribution Check — 2026-09-04 #58352

Closed

pelikhan merged commit 757e3a3 into main Sep 4, 2026
103 of 115 checks passed

pelikhan deleted the copilot/investigate-zizmor-failure branch September 4, 2026 02:16

This was referenced Sep 4, 2026

Suggested test: copilot/strict-mode-compile-zizmor-regression githubnext/gh-aw-test#14028

Open

Smoke Test: MAI-Code-1-Flash - 33931689927 #58644

Closed

Navigation Menu

Uh oh!

Fix zizmor 1.29 finding path parsing - #58339

Fix zizmor 1.29 finding path parsing#58339
pelikhan merged 1 commit into
mainfrom
copilot/investigate-zizmor-failure

Copilot AI commented Sep 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 4, 2026 •

edited

Loading

Uh oh!

github-actions Bot left a comment

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

github-actions Bot left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Skills-Based Review 🧠

Root cause analysis

Regression coverage

Positive Highlights

Uh oh!

github-actions Bot commented Sep 4, 2026

Comment Memory

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Verdict

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟢 Approval recommended

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading

github-actions Bot commented Sep 4, 2026 •

edited

Loading