#!/usr/bin/env bash
set -euo pipefail

manifest="$(mktemp)"
trap 'rm -f "$manifest"' EXIT

curl -fsSL \
  'https://raw.githubusercontent.com/zizmorcore/zizmor-pre-commit/v1.29.0/.pre-commit-hooks.yaml' \
  > "$manifest"

grep -n '^files:' "$manifest"
if grep -Eq '\.pre-commit-config\.ya?ml' "$manifest"; then
  echo "The upstream hook now includes pre-commit configuration files."
  exit 1
fi

set -u

echo '--- local configuration ---'
sed -n '65,90p' .pre-commit-config.yaml

echo '--- upstream hook manifest ---'
curl -fsSL \
  'https://raw.githubusercontent.com/zizmorcore/zizmor-pre-commit/v1.29.0/.pre-commit-hooks.yaml' \
  | sed -n '1,120p'

set -u

echo '--- v1.29.0 release note ---'
curl -fsSL 'https://raw.githubusercontent.com/zizmorcore/zizmor/v1.29.0/CHANGELOG.md' \
  | grep -in -A8 -B4 'pre-commit' || true

echo '--- usage documentation references ---'
for url in \
  'https://raw.githubusercontent.com/zizmorcore/zizmor/v1.29.0/docs/usage.md' \
  'https://raw.githubusercontent.com/zizmorcore/zizmor/v1.29.0/docs/integrations.md'
do
  echo "URL: $url"
  curl -fsSL "$url" | grep -in -A5 -B5 'pre-commit' || true
done

echo '--- proposed file pattern behavior ---'
python3 - <<'PY'
import re
pattern = r'^(\.github/(workflows/.*|dependabot\.ya?ml)|(?:.*/)?action\.ya?ml|\.pre-commit-config\.ya?ml)$'
for path in [
    ".pre-commit-config.yaml",
    ".github/workflows/ci.yml",
    ".github/dependabot.yml",
    "sub/action.yaml",
    "action.yml",
    ".github/actions/action.yml",
    "README.md",
]:
    print(f"{path}: {bool(re.fullmatch(pattern, path))}")
PY

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.pre-commit-config.yaml around lines 77 - 80, Update the zizmor hook
configuration at rev v1.29.0 to add a local files override that includes
.pre-commit-config.yaml in its audit scope, while preserving the existing hook
id and repository configuration.

#!/bin/bash
set -eu

printf '%s\n' '--- zizmor.yml ---'
cat -n zizmor.yml

printf '%s\n' '--- zizmor hook ---'
sed -n '65,90p' .pre-commit-config.yaml

printf '%s\n' '--- local zizmor references ---'
rg -n -i 'excessive-permissions|zizmor' . --glob '!node_modules' --glob '!dist' --glob '!build' | head -200

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@zizmor.yml` around lines 2 - 3, Remove the excessive-permissions
configuration block from zizmor.yml so the audit remains enabled; do not disable
the complete audit, and use only a documented targeted ignore for any confirmed
false positive.