Repository navigation

[pre-commit.ci] pre-commit autoupdate #368

	name: GitHub Actions Security Analysis with zizmor 🌈

	on:
	push:
	branches: ["main"]
	pull_request:
	branches: ["**"]

	permissions: {}

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	jobs:
	zizmor:
	name: Run zizmor
	runs-on: ubuntu-latest
	permissions:
	security-events: write # for uploading SARIF results to GitHub code scanning

	steps:
	- name: Checkout repository
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Install uv
	uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1

	- name: Run zizmor 🌈
	run: uvx zizmor --pedantic --format=sarif .github > results.sarif

	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
	with:
	sarif_file: results.sarif
	category: zizmor