blob: ee3401295503e2542164499f8ea7cd825d3ff43e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
name: Workflow Security
# zizmor reads the workflows of this repository for what makes a workflow
# unsafe: a token that is wider than its job needs, text from a pull request
# that reaches a shell, an action that is not pinned. Its findings are
# uploaded to code scanning.
on:
pull_request:
push:
branches:
- main
permissions: {}
concurrency:
group: zizmor-${{ github.ref }}
cancel-in-progress: true
jobs:
zizmor:
name: zizmor
runs-on: ubuntu-latest
timeout-minutes: 10
permissions:
actions: read
contents: read
security-events: write
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
with:
persist-credentials: false
- name: Audit the workflows
uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
|