diff options
| author | Patrick Linnane <patrick@linnane.io> | 2025-04-01 14:56:27 -0700 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2025-04-01 17:56:27 -0400 |
| commit | 6af7c5891fd8b459f24577e4e85add05f966840e (patch) | |
| tree | 78cb5aebbd35a46317680d09fba69e3223ea154e | |
| parent | 661d72474b8b879c5eca86c16ca5b95eaa59c101 (diff) | |
| download | anubis-6af7c5891fd8b459f24577e4e85add05f966840e.tar.xz anubis-6af7c5891fd8b459f24577e4e85add05f966840e.zip | |
ci: add `zizmor` (#188)
Signed-off-by: Patrick Linnane <patrick@linnane.io>
| -rw-r--r-- | .github/workflows/zizmor.yml | 35 | ||||
| -rw-r--r-- | docs/docs/CHANGELOG.md | 1 |
2 files changed, 36 insertions, 0 deletions
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..c2a03ab --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,35 @@ +name: zizmor + +on: + push: + paths: + - '.github/workflows/*.ya?ml' + pull_request: + paths: + - '.github/workflows/*.ya?ml' + +jobs: + zizmor: + name: zizmor latest via PyPI + runs-on: ubuntu-latest + permissions: + security-events: write + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + persist-credentials: false + + - name: Install the latest version of uv + uses: astral-sh/setup-uv@v5 + + - name: Run zizmor 🌈 + run: uvx zizmor --format sarif . > results.sarif + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: results.sarif + category: zizmor diff --git a/docs/docs/CHANGELOG.md b/docs/docs/CHANGELOG.md index b7e1336..e55eaea 100644 --- a/docs/docs/CHANGELOG.md +++ b/docs/docs/CHANGELOG.md @@ -30,6 +30,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 - Disabled running integration tests on Windows hosts due to it's reliance on posix features (see [#133](https://github.com/TecharoHQ/anubis/pull/133#issuecomment-2764732309)). - Added support for passing the ed25519 signing key in a file with `-ed25519-private-key-hex-file` or `ED25519_PRIVATE_KEY_HEX_FILE`. - Fixed minor typos +- Added `zizmor` for GitHub Actions static analysis ## v1.15.1 |