# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
# SPDX-License-Identifier: MPL-2.0 WITH AdditionRef-Progmasoft-Exception-2.0

name: Workflow Security

# zizmor reads the workflows of this repository for what makes a workflow
# unsafe: a token that is wider than its job needs, text from a pull request
# that reaches a shell, an action that is not pinned. Its findings are
# uploaded to code scanning.

on:
  pull_request:
  push:
    branches:
      - devel

permissions: {}

concurrency:
  group: zizmor-${{ github.ref }}
  cancel-in-progress: true

jobs:
  zizmor:
    name: zizmor
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      actions: read
      contents: read
      security-events: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          persist-credentials: false

      - name: Audit the workflows
        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4