Comment by woodruffw

20 hours ago

zizmor wouldn’t catch that condition at the moment, although it does have similar checks for other unsound conditions and incorrect/vulnerable bot actor checks. This one wouldn’t be too hard to add, though.

(Source: I am zizmor’s maintainer.)

1 comment

woodruffw

btown 19 hours ago

That would be awesome - and thanks for your work, I'll want to start using it!

Nullable event payloads silently null-coalescing to '' are a real "spooky action at a distance" kind of issue, because something that works perfectly when running and being QA'd on PRs, can silently fall apart if made to also run on the main/develop branch (which is only really monitored if the "build breaks," and thus a silent failure or skip might easily sneak through).

Our codebase indeed has comments like this, without which we'd be totally lost:

    # Note contains('') is false if there is no PR at all e.g. on a push to develop,
    # so this will always run on pushes to the develop branch.
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'ci-skip-backend') }}

I imagine that's true of others as well!