chore(main): release 0.2.6 (#35) #93
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: zizmor | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| permissions: {} | |
| concurrency: | |
| group: zizmor-${{ github.workflow }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| jobs: | |
| zizmor: | |
| name: zizmor | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: read | |
| actions: read # zizmor reads workflow run metadata for online audits | |
| security-events: write # upload SARIF to GitHub code scanning | |
| steps: | |
| # paths-filter needs a git checkout — it runs `git branch --show-current` | |
| # before any API fallback, and fails outside a working tree. | |
| - name: Checkout | |
| uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 | |
| with: | |
| persist-credentials: false | |
| # Audit only when something zizmor cares about changed. Keeps the job a | |
| # required check that always reports a status, while skipping the | |
| # API-heavy audit (and SARIF upload) on unrelated PRs. | |
| - name: Detect workflow changes | |
| id: changes | |
| uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 | |
| with: | |
| token: ${{ secrets.GITHUB_TOKEN }} | |
| filters: | | |
| github: | |
| - '.github/**' | |
| - 'zizmor.yml' | |
| - name: Install uv | |
| if: steps.changes.outputs.github == 'true' | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| - name: Run zizmor | |
| if: steps.changes.outputs.github == 'true' | |
| run: uvx zizmor --format=sarif .github/ > zizmor.sarif | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload zizmor SARIF to code scanning | |
| if: steps.changes.outputs.github == 'true' | |
| uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5 | |
| with: | |
| sarif_file: zizmor.sarif | |
| category: zizmor |