.github/workflows/ci.yaml (1)

361-374: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Move workflow expressions out of run: to satisfy zizmor.

The new flags are fine, but Lines 363 and 374 still interpolate ${{ ... }} directly into the shell body. The matrix values shown here are hardcoded, so this is not an exploitable injection path today, but zizmor will keep flagging the step until those expressions are moved into env: (or otherwise removed from run:).

Suggested shape

       - name: Run CPython tests
+        env:
+          RUSTPYTHON_SKIP_ENV_POLLUTERS: true
+          EXTRA_TEST_ARGS: ${{ join(matrix.extra_test_args, ' ') }}
+          SKIPS: ${{ join(matrix.skips, ' ') }}
         run: |
-          target/release/rustpython -u -W error -bb -E -m test -j ${{ steps.cores.outputs.cores }} ${{ join(matrix.extra_test_args, ' ') }} --slowest --fail-env-changed --timeout 600 -x ${{ env.FLAKY_MP_TESTS }} ${{ join(matrix.skips, ' ') }}
+          read -r -a extra_test_args <<< "$EXTRA_TEST_ARGS"
+          read -r -a skips <<< "$SKIPS"
+          target/release/rustpython -u -W error -bb -E -m test -j ${{ steps.cores.outputs.cores }} "${extra_test_args[@]}" --slowest --fail-env-changed --timeout 600 -x ${{ env.FLAKY_MP_TESTS }} "${skips[@]}"
         timeout-minutes: ${{ matrix.timeout }}
-        env:
-          RUSTPYTHON_SKIP_ENV_POLLUTERS: true

As per coding guidelines, "If you modify any file under .github/workflows/, the change must pass a zizmor scan in CI."

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yaml around lines 361 - 374, Move the workflow
expressions out of the shell bodies in the CPython test steps so zizmor stops
flagging them. In the “Run CPython tests” and “Run flaky MP CPython tests”
steps, take the `${{ ... }}` values currently embedded in `run:` (for example
the matrix args and flaky test flags) and pass them through `env:` instead, then
reference the environment variables inside the commands. Keep the existing step
names and test commands in `.github/workflows/ci.yaml`, but ensure `run:`
contains no direct GitHub Actions expressions.

Sources: Coding guidelines, Linters/SAST tools

.github/workflows/ci.yaml (1)

374-399: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Keep -W error out of these special-purpose retry loops.

Line 399’s loop only recognizes exit code 3 as “still polluting”. With -W error, a warning now fails with a different status, so the job can incorrectly report “no longer polluting” even though it never saw a clean run. The same flag on Line 374 also turns deterministic warning failures into five pointless retries.

Suggested fix

-            target/release/rustpython -u -W error -bb -E -m test -j 1 ${{ join(matrix.extra_test_args, ' ') }} --slowest --fail-env-changed --timeout 600 ${{ env.FLAKY_MP_TESTS }}
+            target/release/rustpython -u -bb -E -m test -j 1 ${{ join(matrix.extra_test_args, ' ') }} --slowest --fail-env-changed --timeout 600 ${{ env.FLAKY_MP_TESTS }}

-              target/release/rustpython -u -W error -bb -E -m test -j 1 --slowest --fail-env-changed --timeout 600 "${thing}"
+              target/release/rustpython -u -bb -E -m test -j 1 --slowest --fail-env-changed --timeout 600 "${thing}"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yaml around lines 374 - 399, Remove the `-W error` flag
from the retry-based test invocations in the CI workflow so these loops don’t
turn warnings into different failure modes; update the `rustpython` command used
in the retry loop and the cpython env-polluter check to rely on the existing
exit-code logic instead. Keep the special handling in the retry loops (`status`,
`--fail-env-changed`, and the `thing`/`TARGETS` iterations) unchanged so exit
code `3` remains the only signal for continued pollution.