Merge pull request #151 from edera-dev/release/2026-06-16T18-05-46Z #319
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: GitHub Actions Security Analysis | |
| on: | |
| push: | |
| branches: ["main"] | |
| pull_request: | |
| branches: ["**"] | |
| permissions: | |
| contents: read # Default token to read | |
| jobs: | |
| zizmor: | |
| name: zizmor latest via PyPI | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # Needed to write security events to github | |
| contents: read # Needed to read clone repo | |
| actions: read # Needed to read actions | |
| steps: | |
| - name: Harden the runner (Audit all outbound calls) | |
| uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4 | |
| with: | |
| egress-policy: audit | |
| - name: Checkout repository | |
| uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 | |
| with: | |
| persist-credentials: false | |
| - name: Install the latest version of uv | |
| uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 | |
| - name: Run zizmor | |
| run: uvx zizmor --pedantic --format sarif . > results.sarif | |
| env: | |
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Upload SARIF file | |
| uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v4.36.1 | |
| with: | |
| sarif_file: results.sarif | |
| category: zizmor |