[TheMeier]

address zizmor gh action vulnerabilities

Pull Request Checklist

Please check all the applicable boxes.

• Please list all open issue(s) discussed with maintainers related to this change
  • Fixes #
• Is this a new Receiver integration?
  • I have already tried to use the Webhook Receiver Integration and 3rd party integrations before adding this new Receiver Integration
• Is this a bugfix?
  • I have added tests that can reproduce the bug which pass with this bugfix applied
• Is this a new feature?
  • I have added tests that test the new feature's functionality
• Does this change affect performance?
  • I have provided benchmarks comparison that shows performance is improved or is not degraded
    • You can use benchstat to compare benchmarks
  • I have added new benchmarks if required or requested by maintainers
• Is this a breaking change?
  • My changes do not break the existing cluster messages
  • My changes do not break the existing api
• I have added/updated the required documentation
• I have signed-off my commits
• I will follow best practices for contributing to this project

Which user-facing changes does this PR introduce?

NONE

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: prometheus/alertmanager
• Branch: main
• File: .coderabbit.yaml
• Commit: 294c544
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: ebb8947e-e1c3-40ce-8c6a-1d38ec15de95

Commits

Reviewing files that changed from the base of the PR and between 294c544 and 935a7bc.

Files selected for processing: 6

• .github/dependabot.yml
• .github/workflows/approve-workflows.yml
• .github/workflows/build-release-branch.yml
• .github/workflows/ci.yml
• .github/workflows/publish.yml
• .github/workflows/release.yml

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Walkthrough

Dependabot configurations add seven-day cooldowns for four update types. GitHub Actions workflows update permissions, an artifact upload action version, an annotation, a comment, and reusable-workflow references.

Changes: Dependabot cooldowns

Layer / File(s)	Summary
Set update cooldowns .github/dependabot.yml	The gomod, docker, github-actions, and npm update configurations add seven-day default cooldowns. The existing monthly schedule for GitHub Actions remains.

GitHub Actions workflows

Layer / File(s)	Summary
Update workflow permissions and action configuration .github/workflows/ci.yml, .github/workflows/approve-workflows.yml	The CI workflow sets contents to read and updates actions/upload-artifact to v7.0.1. The approval workflow adds a zizmor: ignore[dangerous-triggers] annotation and a comment about the pinned action’s access requirements and API usage.
Update reusable-workflow references .github/workflows/build-release-branch.yml, .github/workflows/publish.yml, .github/workflows/release.yml	The ci jobs change their reusable-workflow references from ./.github/workflows/ci.yml to $/ .github/workflows/ci.yml.

Priority: Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: Minimal · up to 935a7

The workflow and Dependabot configuration changes are mergeable with no established release-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly identifies the CI scope and the main change: applying zizmor findings to GitHub workflows.
Description check		The description follows the repository template, states the change intent, and provides the required release-notes value of NONE. The checklist remains largely unchecked, but the omitted items are mos…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description follows the repository template, states the change intent, and provides the required release-notes value of NONE. The checklist remains largely unchecked, but the omitted items are mostly not applicable to workflow-only changes.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (6 skipped: 6 unsupported.)

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}