Feat: Surface all zizmor findings at any level

[ModeSevenIndustrialSolutions]

Feat: Surface all zizmor findings at any level

Both zizmor workflows ran with min-severity: 'low', which keeps informational findings out of the SARIF entirely. Real issues were therefore invisible to the PR gate, to code scanning, and to the org security report.

Evidence

A scan of python-workflows produced 14 template-injection findings under the default floor. At the settings CI actually used, zizmor reports:

No findings to report. Good job! (14 ignored)

Those 14 were genuine — they're being fixed in python-workflows#38 — yet the org report showed "Zizmor Static Analysis: ✅ 110 Clean" for every repository.

Changes

	Before	After
zizmor.yaml floor	low	informational
zizmor-sarif-publish.yaml floor	low	informational
PR gate BLOCK set	error, warning, note	+ none
Gate wording	"low severity or higher"	any finding, any level

Both workflows keep identical settings, as their comments require.

The design assumption that changed

The old comments justified the low floor like this:

zizmor emits Low AND Informational findings at SARIF level note … lowering the floor to informational would let informational findings into the SARIF where they are indistinguishable from Low.

That collision is real, but it no longer matters, because neither consumer needs to separate the tiers:

• the PR gate now blocks on any finding regardless of level;
• the github-security-report tool cuts at INFORMATIONAL (see github-security-report-action#72), so both tiers are reported.

Worth recording for the future: the raw SARIF does carry a zizmor/severity property ("Informational" vs "Low"), so the tiers are separable at that layer. The code-scanning alerts API does not expose it, which is why the downstream tool cannot use it and cuts low instead. All three stale comments have been rewritten to say this rather than the old rationale.

Expected impact

This will surface previously-hidden findings across the estate — the PR gate will start failing on informational findings that used to pass silently, and the org report's zizmor row will stop reading "Clean" for repositories that have them. That is the intent.

Validation

• pre-commit run --files … — all hooks pass (yamllint, actionlint, workflow schema validation, reuse lint, codespell)
• zizmor --persona auditor --min-severity informational on both changed files — zero findings

[Copilot]

Pull request overview

This PR updates the organization-wide zizmor workflows so all findings (including informational) are included in SARIF and therefore surfaced to both the PR gate and downstream consumers (code scanning / org security reporting).

Changes:

• Lower zizmor min-severity from low to informational in both workflows so informational findings are emitted into SARIF.
• Update the PR gate logic and messaging to fail on any SARIF result level, including none, aligning behavior with the new floor.
• Refresh workflow comments to document the SARIF “note” level collision (Low vs Informational) and why it’s acceptable with the new gating/reporting approach.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/zizmor.yaml	Switches zizmor scan floor to informational and updates the gate to block on any finding (any SARIF level), with updated rationale comments.
.github/workflows/zizmor-sarif-publish.yaml	Switches publisher scan floor to informational and updates comments to match the gate’s new “any finding” posture.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zxiiro]

🤖 Auto-approved by agent: reviewed workflow change for security and CI/CD impact, found low risk. Companion to github-security-report-action#80: lowers zizmor's min-severity floor to 'informational' and the PR gate now blocks on any finding at any level (strictly tightens the existing gate, doesn't loosen it); shell step still only reads a fixed local SARIF file path, no new permissions/secrets.