From 7538a5c5972a6a4da22f5247ad5a1fcef221b4ab Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 11:39:32 -0400 Subject: [PATCH] chore(ci): follow trusted Renovate validator main Keep third-party actions hash-pinned and allow ref pinning only for the internal Renovate validator workflow. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/renovate.yml | 2 +- .github/zizmor.yml | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 2e5b463..f469b8d 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -16,4 +16,4 @@ jobs: validate: permissions: contents: read - uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@9c4075a1057c2853a339517fde4063ceccfce861 # main + uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@main diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..b22a2a2 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,6 @@ +rules: + unpinned-uses: + config: + policies: + "*": hash-pin + "gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml": ref-pin