From cacef9adc88f7c05f403d9c937af302bb6fb4dc7 Mon Sep 17 00:00:00 2001 From: David Wagih Date: Mon, 22 Jun 2026 20:44:54 +0300 Subject: [PATCH] Add zizmor workflow for GitHub Actions static analysis Runs zizmor (https://docs.zizmor.sh) on push and pull_request to scan the repository's GitHub Actions workflows for security issues and uploads results as SARIF to Code Scanning. Findings are reported but do not fail the build. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/zizmor.yml | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 00000000..d52ad938 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,32 @@ +name: zizmor + +# Static analysis of GitHub Actions workflows with zizmor +# (https://docs.zizmor.sh). Results are uploaded as SARIF to +# Code Scanning; findings do not fail the build. + +on: + push: + branches: [master] + pull_request: + branches: [master] + +permissions: {} + +jobs: + zizmor: + runs-on: ubuntu-latest + permissions: + actions: read + contents: read + security-events: write # SARIF upload to Code Scanning + steps: + - name: Checkout code + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + with: + min-severity: low + min-confidence: low