Repository: zizmorcore/zizmor (Rust)

Issue:
[BUG]: zizmor errors on "slightly incorrect" dependabot.yml
### Pre-submission checks

- [x] I am **not** filing a feature request. These should be filed via the feature request form instead.
- [x] I have checked the [Troubleshooting Guide](https://docs.zizmor.sh/troubleshooting) for my problem.
- [x] I have looked through both the [open](https://github.com/zizmorcore/zizmor/issues?q=is%3Aissue+is%3Aopen+) and [closed](https://github.com/zizmorcore/zizmor/issues?q=is%3Aissue%20state%3Aclosed) issues for a duplicate report.

### zizmor version

1.16.1

### Expected behavior

I think it would be better if it complains with a lint, but seems like it shouldn't crash entirely? It also instructs me to file a bug.

### Actual behavior

Zizmor errors out with dependabot.yml such as the following:
```
version: 2
updates:
  - package-ecosystem: github-actions
    directory: /
    schedule:
      interval: monthly
      # this is the bug, i quickly changed from 'weekly' to 'monthly' and forgot
      day: sunday
    commit-message:
      prefix: ci
    labels:
      - dependencies
```

The "day" is slightly wrong but not fatal, dependabot still sends monthly updates. But they might come on e.g. a saturday. However zizmor crashes.

```
🌈 zizmor v1.16.1
ERROR collect_inputs: github_actions_models::common: msg="`schedule.day` is only valid when `schedule.interval` is `weekly`"
fatal: no audit was performed
failed to load file://./.github/dependabot.yml as dependabot config

Caused by:
    0: couldn't turn input into a an appropriate model
    1: this suggests a bug in zizmor; please report it!
    2: updates[0]: `schedule.day` is only valid when `schedule.interval` is `weekly` at line 3 column 5
```

### Reproduction steps

Have a slightly wrong dependabot.yml that is configured for 'monthly' but also 'sunday'. Run `zizmor .`

### Logs

```plain text

```

### Additional context

_No response_


Discussion:
Hi @rmuir, thanks for the report!

Yeah, this is a bug -- your Dependabot is indeed slightly incorrect, but zizmor's execution guarantee is that we don't reject things that GitHub themselves don't reject even when their docs say they should 🙂 

I'll have a fix for this in a bit.
From blame: #1247 introduced the change that caused this.
#1308 will fix this.
This will be in the next patch release. Thanks again @rmuir!
wow, thank you for the fix!



Patch:
diff --git a/crates/github-actions-models/src/dependabot/v2.rs b/crates/github-actions-models/src/dependabot/v2.rs
index c9acb3e65..efa0d75ac 100644
--- a/crates/github-actions-models/src/dependabot/v2.rs
+++ b/crates/github-actions-models/src/dependabot/v2.rs
@@ -442,11 +442,10 @@ impl<'de> Deserialize<'de> for Schedule {
             ));
         }
 
-        if schedule.interval != Interval::Weekly && schedule.day.is_some() {
-            return Err(custom_error::<D>(
-                "`schedule.day` is only valid when `schedule.interval` is `weekly`",
-            ));
-        }
+        // NOTE(ww): `day` only makes sense with `interval: weekly`, but
+        // Dependabot appears to silently ignore it otherwise. Consequently,
+        // we don't check that for now.
+        // See https://github.com/zizmorcore/zizmor/issues/1305.
 
         Ok(schedule)
     }
diff --git a/docs/release-notes.md b/docs/release-notes.md
index dc1e208ff..3af1a1f13 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -17,6 +17,12 @@ of `zizmor`.
   accordingly, improving the quality of panic reports when running
   in CI (#1307)
 
+### Bug Fixes 🐛
+
+* Fixed a bug where `zizmor` would reject some Dependabot configuration
+  files with logically unsound schedules (but that are accepted by GitHub
+  regardless) (#1308)
+
 ## 1.16.1
 
 ### Enhancements 🌱


Test patch:
diff --git a/crates/github-actions-models/tests/sample-dependabot/v2/day-on-daily.invalid.yml b/crates/github-actions-models/tests/sample-dependabot/v2/day-on-daily.invalid.yml
deleted file mode 100644
index 01dcdaaf1..000000000
--- a/crates/github-actions-models/tests/sample-dependabot/v2/day-on-daily.invalid.yml
+++ /dev/null
@@ -1,7 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: npm
-    directory: "/"
-    schedule:
-      interval: daily
-      day: monday
diff --git a/crates/github-actions-models/tests/sample-dependabot/v2/issue-1305.yml b/crates/github-actions-models/tests/sample-dependabot/v2/issue-1305.yml
new file mode 100644
index 000000000..72fe48b3c
--- /dev/null
+++ b/crates/github-actions-models/tests/sample-dependabot/v2/issue-1305.yml
@@ -0,0 +1,13 @@
+# https://github.com/zizmorcore/zizmor/issues/1305
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+      day: sunday
+    commit-message:
+      prefix: ci
+    labels:
+      - dependencies
diff --git a/crates/github-actions-models/tests/test_dependabot_v2.rs b/crates/github-actions-models/tests/test_dependabot_v2.rs
index af1b05d9f..6a55a72aa 100644
--- a/crates/github-actions-models/tests/test_dependabot_v2.rs
+++ b/crates/github-actions-models/tests/test_dependabot_v2.rs
@@ -115,15 +115,6 @@ fn test_schedule_cronjob_rejected_for_non_cron() {
     );
 }
 
-#[test]
-fn test_schedule_day_only_for_weekly() {
-    let err = load_dependabot_result("day-on-daily.invalid.yml").unwrap_err();
-    assert!(
-        err.to_string()
-            .contains("`schedule.day` is only valid when `schedule.interval` is `weekly`")
-    );
-}
-
 #[test]
 fn test_schedule_weekly_accepts_day() {
     let dependabot = load_dependabot("weekly-with-day.yml");