FilesExpand file tree

main

/

scan-workflows.yml

Copy path

View runs

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

43 lines (37 loc) · 1.08 KB

main

/

scan-workflows.yml

Copy path

Top

File metadata and controls

• Code
• Blame

43 lines (37 loc) · 1.08 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

name: Scan workflows

on:

pull_request:

branches:

- "**"

paths:

# Run for changes to *any* workflow file

- ".github/workflows/*.yml"

push:

branches:

- main

# Require explicit job permissions

permissions: {}

jobs:

zizmor:

name: zizmor latest via PyPI

runs-on: ubuntu-latest

permissions:

security-events: write

steps:

- name: Checkout repository

uses: actions/checkout@v4

with:

persist-credentials: false

- name: Install the latest version of uv

# https://github.com/astral-sh/setup-uv/releases/tag/v6.1.0

uses: astral-sh/setup-uv@f0ec1fc3b38f5e7cd731bb6ce540c5af426746bb

- name: Run zizmor 🌈

# Only scan this repo's workflows, not anything in submodules

run: uvx zizmor==1.8.0 --format sarif .github > results.sarif

env:

GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Upload SARIF file

uses: github/codeql-action/upload-sarif@v3

with:

sarif_file: results.sarif

category: zizmor