From 27c56a57a5ca399696fbdc41b94f968757c79744 Mon Sep 17 00:00:00 2001 From: Wes Tarle Date: Wed, 29 Jul 2026 11:23:59 +0000 Subject: [PATCH] ci: enforce pedantic zizmor GitHub Actions security analysis - Add .github/workflows/zizmor.yml running zizmor-action in pedantic persona - Add concurrency throttling blocks to all workflow files - Add explicit job and workflow names to anonymous definitions - Document write permissions with explanatory inline comments - Pin container images by sha256 digest - Scope pull-requests: write permission in assign-reviewers.yml to job level - Switch assign-reviewers.yml trigger to pull_request --- .github/workflows/assign-reviewers.yml | 9 ++- .github/workflows/codeql-autogenerated.yml | 22 +++-- .github/workflows/codeql-handwritten.yml | 22 +++-- .github/workflows/codeql-repo.yml | 22 +++-- .github/workflows/conformance-test.yaml | 9 ++- .github/workflows/conformance.yaml | 11 ++- .github/workflows/continuous.yaml | 5 ++ .github/workflows/discovery.yaml | 6 ++ .github/workflows/generator-tests.yaml | 12 ++- .github/workflows/issues-no-repro.yaml | 13 ++- .github/workflows/mandatory-conformance.yaml | 11 ++- .github/workflows/presubmit.yaml | 6 ++ .github/workflows/response.yml | 18 +++-- .../system-tests-against-emulator.yaml | 80 +++++++++++-------- .github/workflows/update-api-list.yaml | 11 ++- .github/workflows/windows-presubmit.yaml | 5 ++ .github/workflows/zizmor.yml | 38 +++++++++ 17 files changed, 208 insertions(+), 92 deletions(-) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/assign-reviewers.yml b/.github/workflows/assign-reviewers.yml index a917a32d7bb3..d62002b20e39 100644 --- a/.github/workflows/assign-reviewers.yml +++ b/.github/workflows/assign-reviewers.yml @@ -8,12 +8,19 @@ on: types: [opened, ready_for_review, reopened, synchronize] permissions: - pull-requests: write contents: read +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: assign-reviewers: + name: assign-reviewers runs-on: ubuntu-latest + permissions: + pull-requests: write # Required to add requested reviewers and teams to pull requests + contents: read if: github.event.pull_request.draft == false steps: - name: Assign Reviewers diff --git a/.github/workflows/codeql-autogenerated.yml b/.github/workflows/codeql-autogenerated.yml index 262caafadc4a..804eec0af103 100644 --- a/.github/workflows/codeql-autogenerated.yml +++ b/.github/workflows/codeql-autogenerated.yml @@ -10,6 +10,10 @@ on: schedule: - cron: '0 2 * * *' +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: analyze: name: Analyze (${{ matrix.language }}) @@ -17,17 +21,11 @@ jobs: # - https://gh.io/recommended-hardware-resources-for-running-codeql # - https://gh.io/supported-runners-and-hardware-resources # - https://gh.io/using-larger-runners (GitHub.com only) - # Consider using larger runners or machines with greater resources for possible analysis time improvements. runs-on: ubuntu-latest permissions: - # required for all workflows - security-events: write - - # required to fetch internal or private CodeQL packs - packages: read - - # only required for workflows in private repositories - actions: read + security-events: write # required for all workflows + packages: read # required to fetch internal or private CodeQL packs + actions: read # only required for workflows in private repositories contents: read strategy: @@ -50,7 +48,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false @@ -62,10 +60,10 @@ jobs: # Initializes the CodeQL tools for scanning - autogen flavour. - name: Initialize CodeQL for autogenerated - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: config-file: .github/codeql/codeql-autogenerated.yml languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis for autogenerated - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 diff --git a/.github/workflows/codeql-handwritten.yml b/.github/workflows/codeql-handwritten.yml index 26a4ad03ded0..885034be8c41 100644 --- a/.github/workflows/codeql-handwritten.yml +++ b/.github/workflows/codeql-handwritten.yml @@ -10,6 +10,10 @@ on: schedule: - cron: '30 1 * * *' +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: analyze: name: Analyze (${{ matrix.language }}) @@ -20,16 +24,10 @@ jobs: # Consider using larger runners or machines with greater resources for possible analysis time improvements. runs-on: ubuntu-latest permissions: - # required for all workflows - security-events: write - - # required to fetch internal or private CodeQL packs - packages: read - - # only required for workflows in private repositories - actions: read + security-events: write # required for all workflows + packages: read # required to fetch internal or private CodeQL packs + actions: read # only required for workflows in private repositories contents: read - strategy: fail-fast: false matrix: @@ -50,7 +48,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false @@ -62,10 +60,10 @@ jobs: # Initializes the CodeQL tools for scanning - handwritten flavour. - name: Initialize CodeQL for handwritten - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: config-file: .github/codeql/codeql-handwritten.yml languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis for handwritten - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 diff --git a/.github/workflows/codeql-repo.yml b/.github/workflows/codeql-repo.yml index e34a4a511754..97e31e611c6c 100644 --- a/.github/workflows/codeql-repo.yml +++ b/.github/workflows/codeql-repo.yml @@ -10,6 +10,10 @@ on: schedule: - cron: '0 1 * * *' +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: analyze: name: Analyze (${{ matrix.language }}) @@ -20,16 +24,10 @@ jobs: # Consider using larger runners or machines with greater resources for possible analysis time improvements. runs-on: ubuntu-latest permissions: - # required for all workflows - security-events: write - - # required to fetch internal or private CodeQL packs - packages: read - - # only required for workflows in private repositories - actions: read + security-events: write # required for all workflows + packages: read # required to fetch internal or private CodeQL packs + actions: read # only required for workflows in private repositories contents: read - strategy: fail-fast: false matrix: @@ -50,7 +48,7 @@ jobs: # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages steps: - name: Checkout repository - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false @@ -62,11 +60,11 @@ jobs: # Initializes the CodeQL tools for scanning - repo meta flavour. - name: Initialize CodeQL for repo meta - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 with: config-file: .github/codeql/codeql-repo.yml languages: ${{ matrix.language }} build-mode: ${{ matrix.build-mode }} - name: Perform CodeQL Analysis for repo meta - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4 + uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 diff --git a/.github/workflows/conformance-test.yaml b/.github/workflows/conformance-test.yaml index 13eb09ab8981..65170fb15f0e 100644 --- a/.github/workflows/conformance-test.yaml +++ b/.github/workflows/conformance-test.yaml @@ -11,14 +11,19 @@ on: paths: - 'handwritten/storage/**' name: conformance +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: conformance-test: + name: conformance-test runs-on: ubuntu-latest steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 14 - run: node --version diff --git a/.github/workflows/conformance.yaml b/.github/workflows/conformance.yaml index c35f95e5afb3..f1d2de5b9490 100644 --- a/.github/workflows/conformance.yaml +++ b/.github/workflows/conformance.yaml @@ -26,8 +26,13 @@ on: paths: - 'handwritten/bigtable/**' name: conformance +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: conformance: + name: conformance runs-on: ubuntu-latest defaults: run: @@ -36,16 +41,16 @@ jobs: matrix: node: [ 18, 20 ] steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: googleapis/cloud-bigtable-clients-test ref: main path: handwritten/bigtable/cloud-bigtable-clients-test persist-credentials: false - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ matrix.node }} - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 diff --git a/.github/workflows/continuous.yaml b/.github/workflows/continuous.yaml index 5fc899b79657..4d7e985eb3fa 100644 --- a/.github/workflows/continuous.yaml +++ b/.github/workflows/continuous.yaml @@ -6,8 +6,13 @@ on: branches: - main name: continuous +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: units: + name: units runs-on: ubuntu-latest strategy: matrix: diff --git a/.github/workflows/discovery.yaml b/.github/workflows/discovery.yaml index 907fbd76301c..df7eba91f221 100644 --- a/.github/workflows/discovery.yaml +++ b/.github/workflows/discovery.yaml @@ -6,9 +6,15 @@ on: - cron: '0 12 * * TUE' workflow_dispatch: name: Update Discovery Generated Types +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: sync: + name: sync runs-on: ubuntu-latest + environment: discovery steps: - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: diff --git a/.github/workflows/generator-tests.yaml b/.github/workflows/generator-tests.yaml index 1702f17e7a8d..d58fc17ff5df 100644 --- a/.github/workflows/generator-tests.yaml +++ b/.github/workflows/generator-tests.yaml @@ -15,13 +15,19 @@ on: - '.github/workflows/generator-tests.yaml' workflow_dispatch: +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: presubmit: + name: presubmit if: github.event_name == 'pull_request' runs-on: ubuntu-latest - container: gcr.io/gapic-images/googleapis:20250404 + environment: presubmit + container: gcr.io/gapic-images/googleapis@sha256:cd3f791dfc4267f522ed0714d95e0b5c64741c69cbeb732dbf99078813d63ade # 20250404 steps: - - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1 with: fetch-depth: 300 persist-credentials: false @@ -37,7 +43,7 @@ jobs: key: ${{ runner.os }}-googleapis-20250422-${{ secrets.CACHE_VERSION }} - name: Setup Node.js - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 24.x diff --git a/.github/workflows/issues-no-repro.yaml b/.github/workflows/issues-no-repro.yaml index fbeb36478429..76af36c3d29c 100644 --- a/.github/workflows/issues-no-repro.yaml +++ b/.github/workflows/issues-no-repro.yaml @@ -6,17 +6,22 @@ on: issues: types: [opened, reopened] +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: close: + name: close runs-on: ubuntu-latest permissions: - issues: write - pull-requests: write + issues: write # Required to comment on and close issues with invalid reproduction links + pull-requests: write # Required to comment on and close pull requests with invalid reproduction links steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 18 - run: npm install diff --git a/.github/workflows/mandatory-conformance.yaml b/.github/workflows/mandatory-conformance.yaml index e5ef9372c656..8f32da3c8d0e 100644 --- a/.github/workflows/mandatory-conformance.yaml +++ b/.github/workflows/mandatory-conformance.yaml @@ -26,8 +26,13 @@ on: paths: - 'handwritten/bigtable/**' name: mandatory-conformance +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: mandatory-conformance: + name: mandatory-conformance runs-on: ubuntu-latest defaults: run: @@ -36,16 +41,16 @@ jobs: matrix: node: [ 18, 20 ] steps: - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: persist-credentials: false - - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: repository: googleapis/cloud-bigtable-clients-test ref: v0.0.3 path: handwritten/bigtable/cloud-bigtable-clients-test persist-credentials: false - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: ${{ matrix.node }} - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5 diff --git a/.github/workflows/presubmit.yaml b/.github/workflows/presubmit.yaml index dc152e2bec88..d16d4ffad86e 100644 --- a/.github/workflows/presubmit.yaml +++ b/.github/workflows/presubmit.yaml @@ -4,8 +4,13 @@ permissions: on: pull_request: name: presubmit +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: units: + name: units runs-on: ubuntu-latest strategy: matrix: @@ -29,6 +34,7 @@ jobs: BUILD_TYPE: presubmit TEST_TYPE: units lint: + name: lint runs-on: ubuntu-latest continue-on-error: true steps: diff --git a/.github/workflows/response.yml b/.github/workflows/response.yml index 0b5d5e8a0313..dea1435e3a17 100644 --- a/.github/workflows/response.yml +++ b/.github/workflows/response.yml @@ -8,15 +8,20 @@ on: workflow_dispatch: issue_comment: +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: close: + name: close if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' runs-on: ubuntu-latest permissions: - issues: write - pull-requests: write + issues: write # Required to comment on and close unresponsive issues labeled awaiting response + pull-requests: write # Required to comment on and close unresponsive pull requests labeled awaiting response steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 @@ -26,13 +31,14 @@ jobs: await script({github, context}) remove_label: + name: remove_label if: github.event_name == 'issue_comment' runs-on: ubuntu-latest permissions: - issues: write - pull-requests: write + issues: write # Required to remove response labels from issues when the author replies + pull-requests: write # Required to remove response labels from pull requests when the author replies steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 diff --git a/.github/workflows/system-tests-against-emulator.yaml b/.github/workflows/system-tests-against-emulator.yaml index fc74ff8c4987..94abed270ffc 100644 --- a/.github/workflows/system-tests-against-emulator.yaml +++ b/.github/workflows/system-tests-against-emulator.yaml @@ -1,34 +1,50 @@ -# on: -# push: -# branches: -# - main -# paths: -# - 'handwritten/spanner/**' -# pull_request: -# paths: -# - 'handwritten/spanner/**' -# name: system-tests-against-emulator -# jobs: -# test: -# runs-on: ubuntu-latest +name: system-tests-against-emulator +on: + push: + branches: + - main + paths: + - 'handwritten/spanner/**' + pull_request: + paths: + - 'handwritten/spanner/**' + workflow_dispatch: -# services: -# emulator: -# image: gcr.io/cloud-spanner-emulator/emulator:latest -# ports: -# - 9010:9010 -# - 9020:9020 +permissions: + contents: read -# steps: -# - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 -# - uses: actions/setup-node@v5 -# with: -# node-version: 22 -# - run: node --version -# - run: npm install -# working-directory: handwritten/spanner -# - run: npm run system-test -# working-directory: handwritten/spanner -# env: -# SPANNER_EMULATOR_HOST: localhost:9010 -# GCLOUD_PROJECT: emulator-test-project \ No newline at end of file +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + +jobs: + test: + name: test + # Temporarily disabled (previously commented out in 28f56445a637f3e8cbef61ab8e2a2669bd388278) + if: false + runs-on: ubuntu-latest + permissions: + contents: read + + services: + emulator: + image: gcr.io/cloud-spanner-emulator/emulator@sha256:ad54472fe7b161b9214f7f816f304b649a4779e348229c375ac067f5ed5a6422 + ports: + - 9010:9010 + - 9020:9020 + + steps: + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 + with: + node-version: 22 + - run: node --version + - run: npm install + working-directory: handwritten/spanner + - run: npm run system-test + working-directory: handwritten/spanner + env: + SPANNER_EMULATOR_HOST: localhost:9010 + GCLOUD_PROJECT: emulator-test-project diff --git a/.github/workflows/update-api-list.yaml b/.github/workflows/update-api-list.yaml index d0fe250a386a..eb1f6b7caf7b 100644 --- a/.github/workflows/update-api-list.yaml +++ b/.github/workflows/update-api-list.yaml @@ -1,3 +1,4 @@ +name: update-api-list permissions: contents: read @@ -6,14 +7,20 @@ on: - cron: "0 1 * * *" workflow_dispatch: +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: update-api-list: + name: update-api-list runs-on: ubuntu-latest + environment: update-api-list steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: 18 - run: npm install diff --git a/.github/workflows/windows-presubmit.yaml b/.github/workflows/windows-presubmit.yaml index 31105cfa46de..50197f8173d2 100644 --- a/.github/workflows/windows-presubmit.yaml +++ b/.github/workflows/windows-presubmit.yaml @@ -4,8 +4,13 @@ permissions: on: pull_request: name: presubmit-windows +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + jobs: units: + name: units runs-on: windows-latest strategy: matrix: diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 000000000000..2048c82bee6b --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,38 @@ +name: zizmor + +on: + push: + branches: + - main + pull_request: + branches: + - main + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + zizmor: + name: zizmor (${{ matrix.persona }}) + runs-on: ubuntu-latest + strategy: + fail-fast: false + matrix: + persona: [pedantic, auditor] + permissions: + security-events: write # Required to upload SARIF results to GitHub Code Scanning + contents: read + steps: + - name: Checkout repository + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + with: + persist-credentials: false + + - name: Run zizmor + uses: zizmorcore/zizmor-action@195d10ad90f31d8cd6ea1efd6ecc12969ddbe73f # v0.5.1 + with: + persona: ${{ matrix.persona }}