Repository: woodruffw/zizmor (rust)

Issue:
[BUG]: panic: called `Option::unwrap()` on a `None` value
### Pre-submission checks

- [x] I am **not** filing a feature request. These should be filed via the feature request form instead.
- [x] I have looked through the [open issues](https://github.com/woodruffw/zizmor/issues?q=is%3Aissue+is%3Aopen+) for a duplicate report.

### Expected behavior

Zizmor doesn't crash

### Actual behavior

Zizmor crashes: https://github.com/docker/actions-toolkit/actions/runs/14377190560/job/40312292178#step:6:25

### Reproduction steps

Workflow can be found here: https://github.com/docker/octoguard/blob/main/.github/workflows/octoguard.yml

### Logs

```
+ zizmor --min-severity=medium --min-confidence=medium --persona=pedantic --no-online-audits --format=sarif .
 INFO zizmor: skipping impostor-commit: offline audits only requested
 INFO zizmor: skipping ref-confusion: offline audits only requested
 INFO zizmor: skipping known-vulnerable-actions: offline audits only requested
 INFO audit: zizmor: 🌈 completed ./.github/actions/macos-setup-qemu/action.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/build.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/buildx-lab-releases-json.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/buildx-releases-json.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/codeql.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/compose-lab-releases-json.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/compose-releases-json.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/docker-releases-json.yml
 INFO audit: zizmor: 🌈 completed ./.github/workflows/publish.yml
Well, this is embarrassing.

zizmor had a problem and crashed. To help us diagnose the problem you can send us a crash report.

We have generated a report file at "/tmp/zizmor/report-777a9d2d-7850-4854-8928-baa2252492b5.toml". Submit an issue or email with the subject of "zizmor Crash Report" and include the report as an attachment.

- Homepage: https://github.com/woodruffw/zizmor
- Authors: William Woodruff <william@yossarian.net>

We take privacy seriously, and do not perform any automated error collection. In order to improve the software, we rely on people to submit reports.

Thank you kindly!
```

Here is the report: [zizmor-crash-report.zip](https://github.com/user-attachments/files/19682310/zizmor-crash-report.zip)

```
"name" = "zizmor"
"operating_system" = "Ubuntu 24.4.0 (noble) [64-bit]"
"crate_version" = "1.5.2"
"explanation" = """
Panic occurred in file '/root/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/yamlpath-0.15.0/src/lib.rs' at line 462
"""
"cause" = "called `Option::unwrap()` on a `None` value"
"method" = "Panic"
"backtrace" = """
   0:     0x558b6eacb90c - rust_begin_unwind
   1:     0x558b6e6c65bf - core::panicking::panic_fmt::hf8ffc7c15bfb58a0
   2:     0x558b6e6c660b - core::panicking::panic::h209220e15dcf6e53
   3:     0x558b6e6c6968 - core::option::unwrap_failed::h12717cc50f158ee2
   4:     0x558b6eb47f52 - yamlpath::Document::query::hd8a74431278e6da2
   5:     0x558b6eb49bb8 - <core::iter::adapters::GenericShunt<I,R> as core::iter::traits::iterator::Iterator>::next::h077889ce72b60e12
   6:     0x558b6ec6310d - zizmor::finding::FindingBuilder::build::h67791fda6043e6aa
   7:     0x558b6eb64788 - <zizmor::audit::unpinned_uses::UnpinnedUses as zizmor::audit::Audit>::audit_step::h2e7014cc4f5dbbb9
   8:     0x558b6eb654bc - zizmor::audit::Audit::audit_normal_job::h7b5056467dfeb94d
   9:     0x558b6eb6573d - zizmor::audit::Audit::audit_workflow::h3bc6c7e082082071
  10:     0x558b6eb688fc - zizmor::audit::Audit::audit::h9a0a2e05716d2a6b
  11:     0x558b6ebf474f - zizmor::run::h103574f0eb933b1c
  12:     0x558b6ebe0578 - zizmor::main::hc579d69b57ce3a97
  13:     0x558b6ec089b3 - std::sys::backtrace::__rust_begin_short_backtrace::hd296e1579dfe1c10
  14:     0x558b6ebe0294 - main
  15:     0x7fd9fca2a1ca - <unresolved>
  16:     0x7fd9fca2a28b - __libc_start_main
  17:     0x558b6e6e783e - _start
  18:                0x0 - <unresolved>
"""
```

### Additional context

Not directly related but is it possible to print the stacktrace instead of creating a report file through a flag or smth like that? Relates to https://github.com/docker/octoguard/issues/8

Pull request description:
bugfix: bump yamlpath, fix #659
This fixes #659 by bumping `yamlpath`, which in turn contains a fix for pathing behavior when a YAML
block sequence contains an interceding comment
between a sequence member and its body.

Patch:
diff --git a/Cargo.lock b/Cargo.lock
index c169f8f..eaa1a50 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3115,9 +3115,9 @@ checksum = "6a5cbf750400958819fb6178eaa83bee5cd9c29a26a40cc241df8c70fdd46984"
 
 [[package]]
 name = "yamlpath"
-version = "0.15.0"
+version = "0.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "796a3f441fd5a8d00a2dac6ca0ce0f0b07b7e1997e014a32d4f17a9d39fbdc9f"
+checksum = "87c585ad15cb2a723978a39719af264133486ee68bd980e214ff43402e7b674a"
 dependencies = [
  "thiserror 2.0.9",
  "tree-sitter",
diff --git a/Cargo.toml b/Cargo.toml
index 3c1f1b3..846de9a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -62,7 +62,7 @@ tracing-subscriber = { version = "0.3.19", features = ["env-filter"] }
 tree-sitter = "0.25.2"
 tree-sitter-bash = "0.23.3"
 tree-sitter-powershell = "0.25.2"
-yamlpath = "0.15.0"
+yamlpath = "0.16.0"
 
 [profile.dev.package]
 insta.opt-level = 3
diff --git a/docs/release-notes.md b/docs/release-notes.md
index b0c0619..222155c 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -41,6 +41,8 @@ of `zizmor`.
 * Fixed a bug where `zizmor` would fail to parse workflows with
   `pull_request` or `pull_request_target` triggers that specified
   `types` as a scalar value (#653)
+* Fixed a crash where `zizmor` would fail to generate correct concrete
+  location spans for YAML inputs with comments inside block sequences (#660)
 
 ## v1.5.2
 


Test patch:
diff --git a/tests/integration/snapshot.rs b/tests/integration/snapshot.rs
index e51d8b1..9d06288 100644
--- a/tests/integration/snapshot.rs
+++ b/tests/integration/snapshot.rs
@@ -163,6 +163,13 @@ fn unpinned_uses() -> Result<()> {
             .run()?
     );
 
+    insta::assert_snapshot!(
+        zizmor()
+            .input(input_under_test("unpinned-uses/issue-659-repro.yml"))
+            .args(["--pedantic"])
+            .run()?
+    );
+
     Ok(())
 }
 
diff --git a/tests/integration/snapshots/integration__snapshot__unpinned_uses-5.snap b/tests/integration/snapshots/integration__snapshot__unpinned_uses-5.snap
new file mode 100644
index 0000000..cbd68fc
--- /dev/null
+++ b/tests/integration/snapshots/integration__snapshot__unpinned_uses-5.snap
@@ -0,0 +1,40 @@
+---
+source: tests/integration/snapshot.rs
+expression: "zizmor().input(input_under_test(\"unpinned-uses/issue-659-repro.yml\")).args([\"--pedantic\"]).run()?"
+---
+warning[excessive-permissions]: overly broad permissions
+  --> @@INPUT@@:1:1
+   |
+ 1 | / # minimized from https://raw.githubusercontent.com/docker/actions-toolkit/59501e62b/.github/workflows/test.yml
+ 2 | | name: issue-659-repro
+...  |
+18 | |         with:
+19 | |           node-version: ${{ env.NODE_VERSION }}
+   | |________________________________________________- default permissions used due to no permissions: block
+   |
+   = note: audit confidence → Medium
+
+warning[excessive-permissions]: overly broad permissions
+  --> @@INPUT@@:8:3
+   |
+ 8 | /   test-itg:
+ 9 | |     runs-on: ${{ matrix.os }}
+...  |
+18 | |         with:
+19 | |           node-version: ${{ env.NODE_VERSION }}
+   | |                                                -
+   | |________________________________________________|
+   |                                                  this job
+   |                                                  default permissions used due to no permissions: block
+   |
+   = note: audit confidence → Medium
+
+help[unpinned-uses]: unpinned action reference
+  --> @@INPUT@@:17:9
+   |
+17 |         uses: actions/setup-node@v4
+   |         --------------------------- help: action is not pinned to a hash ref
+   |
+   = note: audit confidence → High
+
+3 findings: 0 unknown, 0 informational, 1 low, 2 medium, 0 high
diff --git a/tests/integration/test-data/unpinned-uses/issue-659-repro.yml b/tests/integration/test-data/unpinned-uses/issue-659-repro.yml
new file mode 100644
index 0000000..4335313
--- /dev/null
+++ b/tests/integration/test-data/unpinned-uses/issue-659-repro.yml
@@ -0,0 +1,19 @@
+# minimized from https://raw.githubusercontent.com/docker/actions-toolkit/59501e62b/.github/workflows/test.yml
+name: issue-659-repro
+
+on:
+  workflow_dispatch:
+
+jobs:
+  test-itg:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include: ${{ fromJson(needs.prepare-itg.outputs.includes) }}
+    steps:
+      - # FIXME: Needs to setup node twice on Windows due to a bug with runner
+        name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}