docker/actions-toolkit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1046 from crazy-max/zizmor

Browse Source 
zizmor workflow
This commit is contained in:
CrazyMax
2026-03-27 10:45:54 +01:00
committed by GitHub
parent 78126ab93d a4ec5f5780
commit 91c970e007
18 changed files with 154 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.github/dependabot.yml vendored
View File

@@ -5,6 +5,12 @@ updates:
directory: "/" directory: "/"
schedule: schedule:
interval: "daily" interval: "daily"
groups:
crazy-max-dot-github:
patterns:
- "crazy-max/.github/*"
cooldown:
default-days: 2
labels: labels:
- "dependencies" - "dependencies"
- "bot" - "bot"
@@ -13,6 +19,8 @@ updates:
directory: "/" directory: "/"
schedule: schedule:
interval: "daily" interval: "daily"
cooldown:
default-days: 2
versioning-strategy: "increase" versioning-strategy: "increase"
allow: allow:
- dependency-type: "production" - dependency-type: "production"

5
.github/workflows/build.yml vendored
View File

@@ -4,6 +4,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
push: push:
branches: branches:
@@ -24,7 +27,7 @@ jobs:
steps: steps:
- -
name: Build name: Build
uses: docker/bake-action@v7 uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
with: with:
targets: build targets: build
env: env:

11
.github/workflows/buildx-lab-releases-json.yml vendored
View File

@@ -4,6 +4,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
workflow_dispatch: workflow_dispatch:
schedule: schedule:
@@ -22,20 +25,22 @@ jobs:
repository: docker/buildx-desktop repository: docker/buildx-desktop
artifact_name: buildx-lab-releases-json artifact_name: buildx-lab-releases-json
filename: buildx-lab-releases.json filename: buildx-lab-releases.json
secrets: inherit
open-pr: open-pr:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
permissions:
contents: write
pull-requests: write
needs: needs:
- generate - generate
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Download name: Download
uses: actions/download-artifact@v8 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
name: buildx-lab-releases-json name: buildx-lab-releases-json
path: .github path: .github

11
.github/workflows/buildx-releases-json.yml vendored
View File

@@ -4,6 +4,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
workflow_dispatch: workflow_dispatch:
schedule: schedule:
@@ -22,20 +25,22 @@ jobs:
repository: docker/buildx repository: docker/buildx
artifact_name: buildx-releases-json artifact_name: buildx-releases-json
filename: buildx-releases.json filename: buildx-releases.json
secrets: inherit
open-pr: open-pr:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
permissions:
contents: write
pull-requests: write
needs: needs:
- generate - generate
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Download name: Download
uses: actions/download-artifact@v8 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
name: buildx-releases-json name: buildx-releases-json
path: .github path: .github

15
.github/workflows/codeql.yml vendored
View File

@@ -7,9 +7,7 @@ on:
pull_request: pull_request:
permissions: permissions:
actions: read
contents: read contents: read
security-events: write
env: env:
NODE_VERSION: "24" NODE_VERSION: "24"
@@ -17,10 +15,13 @@ env:
jobs: jobs:
analyze: analyze:
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
contents: read
security-events: write
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Enable corepack name: Enable corepack
run: | run: |
@@ -28,19 +29,19 @@ jobs:
yarn --version yarn --version
- -
name: Set up Node name: Set up Node
uses: actions/setup-node@v6 uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with: with:
node-version: ${{ env.NODE_VERSION }} node-version: ${{ env.NODE_VERSION }}
- -
name: Initialize CodeQL name: Initialize CodeQL
uses: github/codeql-action/init@v4 uses: github/codeql-action/init@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
with: with:
languages: javascript-typescript languages: javascript-typescript
- -
name: Autobuild name: Autobuild
uses: github/codeql-action/autobuild@v4 uses: github/codeql-action/autobuild@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
- -
name: Perform CodeQL Analysis name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v4 uses: github/codeql-action/analyze@38697555549f1db7851b81482ff19f1fa5c4fedc # v4.34.1
with: with:
category: "/language:javascript-typescript" category: "/language:javascript-typescript"

11
.github/workflows/compose-lab-releases-json.yml vendored
View File

@@ -4,6 +4,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
workflow_dispatch: workflow_dispatch:
schedule: schedule:
@@ -22,20 +25,22 @@ jobs:
repository: docker/compose-desktop repository: docker/compose-desktop
artifact_name: compose-lab-releases-json artifact_name: compose-lab-releases-json
filename: compose-lab-releases.json filename: compose-lab-releases.json
secrets: inherit
open-pr: open-pr:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
permissions:
contents: write
pull-requests: write
needs: needs:
- generate - generate
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Download name: Download
uses: actions/download-artifact@v8 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
name: compose-lab-releases-json name: compose-lab-releases-json
path: .github path: .github

11
.github/workflows/compose-releases-json.yml vendored
View File

@@ -4,6 +4,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
workflow_dispatch: workflow_dispatch:
schedule: schedule:
@@ -22,20 +25,22 @@ jobs:
repository: docker/compose repository: docker/compose
artifact_name: compose-releases-json artifact_name: compose-releases-json
filename: compose-releases.json filename: compose-releases.json
secrets: inherit
open-pr: open-pr:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
permissions:
contents: write
pull-requests: write
needs: needs:
- generate - generate
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Download name: Download
uses: actions/download-artifact@v8 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
name: compose-releases-json name: compose-releases-json
path: .github path: .github

11
.github/workflows/cosign-releases-json.yml vendored
View File

@@ -4,6 +4,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
workflow_dispatch: workflow_dispatch:
schedule: schedule:
@@ -22,20 +25,22 @@ jobs:
repository: sigstore/cosign repository: sigstore/cosign
artifact_name: cosign-releases-json artifact_name: cosign-releases-json
filename: cosign-releases.json filename: cosign-releases.json
secrets: inherit
open-pr: open-pr:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
permissions:
contents: write
pull-requests: write
needs: needs:
- generate - generate
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Download name: Download
uses: actions/download-artifact@v8 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
name: cosign-releases-json name: cosign-releases-json
path: .github path: .github

11
.github/workflows/docker-releases-json.yml vendored
View File

@@ -4,6 +4,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
workflow_dispatch: workflow_dispatch:
schedule: schedule:
@@ -25,20 +28,22 @@ jobs:
tag_patterns: | tag_patterns: |
^docker-(.*)$ ^docker-(.*)$
^(v.*)$ ^(v.*)$
secrets: inherit
open-pr: open-pr:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
permissions:
contents: write
pull-requests: write
needs: needs:
- generate - generate
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Download name: Download
uses: actions/download-artifact@v8 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
name: docker-releases-json name: docker-releases-json
path: .github path: .github

2
.github/workflows/pr-assign-author.yml vendored
View File

@@ -4,7 +4,7 @@ permissions:
contents: read contents: read
on: on:
pull_request_target: pull_request_target: # zizmor: ignore[dangerous-triggers] does not checkout, safe to use pull_request_target
types: types:
- opened - opened
- reopened - reopened

22
.github/workflows/publish.yml vendored
View File

@@ -1,13 +1,12 @@
name: publish name: publish
permissions:
id-token: write # required for OIDC
contents: write # required to create GitHub Release
concurrency: concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
push: push:
tags: tags:
@@ -19,10 +18,13 @@ env:
jobs: jobs:
publish: publish:
runs-on: ubuntu-latest runs-on: ubuntu-latest
permissions:
contents: read
id-token: write # required for OIDC
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Enable corepack name: Enable corepack
run: | run: |
@@ -30,7 +32,7 @@ jobs:
yarn --version yarn --version
- -
name: Setup Node name: Setup Node
uses: actions/setup-node@v6 uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with: with:
node-version: ${{ env.NODE_VERSION }} node-version: ${{ env.NODE_VERSION }}
cache: 'yarn' cache: 'yarn'
@@ -51,11 +53,3 @@ jobs:
run: | run: |
npm version --no-git-tag-version ${GITHUB_REF#refs/tags/v} npm version --no-git-tag-version ${GITHUB_REF#refs/tags/v}
npm publish --provenance --access public npm publish --provenance --access public
-
name: Create Release
uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
with:
draft: true
generate_release_notes: true
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

11
.github/workflows/regclient-releases-json.yml vendored
View File

@@ -4,6 +4,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
workflow_dispatch: workflow_dispatch:
schedule: schedule:
@@ -22,20 +25,22 @@ jobs:
repository: regclient/regclient repository: regclient/regclient
artifact_name: regclient-releases-json artifact_name: regclient-releases-json
filename: regclient-releases.json filename: regclient-releases.json
secrets: inherit
open-pr: open-pr:
runs-on: ubuntu-latest runs-on: ubuntu-latest
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
permissions:
contents: write
pull-requests: write
needs: needs:
- generate - generate
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Download name: Download
uses: actions/download-artifact@v8 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
name: regclient-releases-json name: regclient-releases-json
path: .github path: .github

31
.github/workflows/test.yml vendored
View File

@@ -4,6 +4,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
workflow_dispatch: workflow_dispatch:
push: push:
@@ -33,10 +36,10 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Test name: Test
uses: docker/bake-action@v7 uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
with: with:
source: . source: .
targets: test-coverage targets: test-coverage
@@ -55,7 +58,7 @@ jobs:
shell: bash shell: bash
- -
name: Upload coverage name: Upload coverage
uses: codecov/codecov-action@v5 uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
if: env.RUN_CODECOV == 'true' && matrix.node_version == env.NODE_VERSION if: env.RUN_CODECOV == 'true' && matrix.node_version == env.NODE_VERSION
with: with:
files: ./coverage/clover.xml files: ./coverage/clover.xml
@@ -69,7 +72,7 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Enable corepack name: Enable corepack
run: | run: |
@@ -77,7 +80,7 @@ jobs:
yarn --version yarn --version
- -
name: Setup Node name: Setup Node
uses: actions/setup-node@v6 uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with: with:
node-version: ${{ env.NODE_VERSION }} node-version: ${{ env.NODE_VERSION }}
cache: 'yarn' cache: 'yarn'
@@ -87,7 +90,7 @@ jobs:
- -
name: Create includes name: Create includes
id: set id: set
uses: actions/github-script@v8 uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with: with:
script: | script: |
let tests = []; let tests = [];
@@ -153,15 +156,15 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Expose GitHub Runtime name: Expose GitHub Runtime
uses: crazy-max/ghaction-github-runtime@v4 uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
- -
# FIXME: Needs to setup node twice on Windows: https://github.com/actions/setup-node/issues/1357#issuecomment-3254613964 # FIXME: Needs to setup node twice on Windows: https://github.com/actions/setup-node/issues/1357#issuecomment-3254613964
name: Setup Node name: Setup Node
if: startsWith(matrix.os, 'windows') if: startsWith(matrix.os, 'windows')
uses: actions/setup-node@v6 uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with: with:
node-version: ${{ env.NODE_VERSION }} node-version: ${{ env.NODE_VERSION }}
package-manager-cache: false package-manager-cache: false
@@ -172,14 +175,14 @@ jobs:
yarn --version yarn --version
- -
name: Setup Node name: Setup Node
uses: actions/setup-node@v6 uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
with: with:
node-version: ${{ env.NODE_VERSION }} node-version: ${{ env.NODE_VERSION }}
cache: 'yarn' cache: 'yarn'
- -
name: Set up Docker Buildx name: Set up Docker Buildx
if: startsWith(matrix.os, 'ubuntu') if: startsWith(matrix.os, 'ubuntu')
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ env.BUILDX_VERSION }} version: ${{ env.BUILDX_VERSION }}
driver: docker driver: docker
@@ -187,7 +190,7 @@ jobs:
name: Set up container builder name: Set up container builder
if: startsWith(matrix.os, 'ubuntu') if: startsWith(matrix.os, 'ubuntu')
id: builder id: builder
uses: docker/setup-buildx-action@v4 uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
with: with:
version: ${{ env.BUILDX_VERSION }} version: ${{ env.BUILDX_VERSION }}
driver-opts: image=${{ env.BUILDKIT_IMAGE }} driver-opts: image=${{ env.BUILDKIT_IMAGE }}
@@ -197,7 +200,7 @@ jobs:
run: yarn install run: yarn install
- -
name: Test name: Test
uses: actions/github-script@v8 uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
with: with:
script: | script: |
const testName = `${{ matrix.test_name }}`; const testName = `${{ matrix.test_name }}`;
@@ -225,7 +228,7 @@ jobs:
shell: bash shell: bash
- -
name: Upload coverage name: Upload coverage
uses: codecov/codecov-action@v5 uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe # v5.5.4
if: env.RUN_CODECOV == 'true' if: env.RUN_CODECOV == 'true'
with: with:
files: ./coverage/clover.xml files: ./coverage/clover.xml

11
.github/workflows/undock-releases-json.yml vendored
View File

@@ -4,6 +4,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
workflow_dispatch: workflow_dispatch:
schedule: schedule:
@@ -22,20 +25,22 @@ jobs:
repository: crazy-max/undock repository: crazy-max/undock
artifact_name: undock-releases-json artifact_name: undock-releases-json
filename: undock-releases.json filename: undock-releases.json
secrets: inherit
open-pr: open-pr:
runs-on: ubuntu-24.04 runs-on: ubuntu-24.04
if: github.event_name != 'pull_request' if: github.event_name != 'pull_request'
permissions:
contents: write
pull-requests: write
needs: needs:
- generate - generate
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Download name: Download
uses: actions/download-artifact@v8 uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
with: with:
name: undock-releases-json name: undock-releases-json
path: .github path: .github

9
.github/workflows/validate.yml vendored
View File

@@ -4,6 +4,9 @@ concurrency:
group: ${{ github.workflow }}-${{ github.ref }} group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true cancel-in-progress: true
permissions:
contents: read
on: on:
workflow_dispatch: workflow_dispatch:
push: push:
@@ -21,11 +24,11 @@ jobs:
steps: steps:
- -
name: Checkout name: Checkout
uses: actions/checkout@v6 uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- -
name: Generate matrix name: Generate matrix
id: generate id: generate
uses: docker/bake-action/subaction/matrix@v7 uses: docker/bake-action/subaction/matrix@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
with: with:
target: validate target: validate
@@ -40,6 +43,6 @@ jobs:
steps: steps:
- -
name: Validate name: Validate
uses: docker/bake-action@v7 uses: docker/bake-action@82490499d2e5613fcead7e128237ef0b0ea210f7 # v7.0.0
with: with:
targets: ${{ matrix.target }} targets: ${{ matrix.target }}

9
.github/workflows/virtual-env.yml vendored
View File

@@ -1,5 +1,12 @@
name: virtual-env name: virtual-env
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
on: on:
workflow_dispatch: workflow_dispatch:
schedule: schedule:
@@ -68,4 +75,4 @@ jobs:
- -
name: Dump context name: Dump context
if: always() if: always()
uses: crazy-max/ghaction-dump-context@v2 uses: crazy-max/ghaction-dump-context@5355a8e5e6ac5a302e746a1c4b7747a0393863c8 # v2.3.0

26
.github/workflows/zizmor.yml vendored Normal file
View File

@@ -0,0 +1,26 @@
name: zizmor
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
permissions:
contents: read
on:
workflow_dispatch:
push:
branches:
- 'main'
pull_request:
jobs:
run:
uses: crazy-max/.github/.github/workflows/zizmor.yml@bbd31df64ee0f097a02f12495f541f9236f18c46 # v1.2.0
permissions:
contents: read
security-events: write
with:
min-severity: medium
min-confidence: medium
persona: pedantic

4
.github/zizmor.yml vendored Normal file
View File

@@ -0,0 +1,4 @@
# https://docs.zizmor.sh/configuration/
rules:
secrets-outside-env: # FIXME: remove this rule when zizmor 1.24.0 is released, fixing the right persona attached to this rule: https://github.com/zizmorcore/zizmor/pull/1783
disable: true