From a61e8e6b79ca7201fff760cf5593470f9d726f9f Mon Sep 17 00:00:00 2001 From: Dan Barr <6922515+danbarr@users.noreply.github.com> Date: Tue, 25 Aug 2026 22:30:42 -0400 Subject: [PATCH] ci: add zizmor GitHub Actions security scan Adds a workflow that runs zizmor against .github/workflows/ on push to main and on PRs that touch workflow files, following the pattern used in docs-website (single job, annotations, no SARIF/Security-tab integration since this repo doesn't have code scanning enabled). Co-Authored-By: Claude Sonnet 5 --- .github/workflows/zizmor.yml | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..dbd07c77 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,35 @@ +name: 'GitHub Actions Security (zizmor)' + +on: + push: + branches: [main] + paths: + - '.github/workflows/**' + pull_request: + paths: + - '.github/workflows/**' + +permissions: {} + +jobs: + zizmor: + name: zizmor + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 + with: + inputs: ./.github/workflows/ + advanced-security: 'false' + annotations: 'true' + # Low/informational findings (e.g. style nits, unexploitable + # low-confidence flags) still show as annotations but don't fail + # the check; only real security-relevant findings gate the PR. + min-severity: medium