From 799aecf244248df11c0204dab98eca2b42718512 Mon Sep 17 00:00:00 2001 From: Colin Dean Date: Mon, 26 Jan 2026 10:08:17 -0500 Subject: [PATCH 1/2] Refactor Zizmor workflow to use zizmor-action Same stuff, but delegate how Zizmor gets installed to zizmor-action. --- .github/workflows/zizmor.yml | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index ae73cf9..c6d9865 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -10,28 +10,16 @@ permissions: {} jobs: zizmor: - name: zizmor latest via PyPI runs-on: ubuntu-latest permissions: security-events: write # needed for SARIF uploads - contents: read # only needed for private repos - actions: read # only needed for private repos + contents: read # only needed for private or internal repos + actions: read # only needed for private or internal repos steps: - name: Checkout repository uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1 with: persist-credentials: false - - name: Install the latest version of uv - uses: astral-sh/setup-uv@681c641aba71e4a1c380be3ab5e12ad51f415867 # v7.1.6 - - name: Run zizmor 🌈 - run: uvx zizmor --format=sarif . > results.sarif - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9 - with: - sarif_file: results.sarif - category: zizmor + uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95 # v0.4.1 From 0b79b1a668d8544f779b4ee1255f57262e3a19a3 Mon Sep 17 00:00:00 2001 From: Colin Dean Date: Mon, 3 Aug 2026 12:57:32 -0400 Subject: [PATCH 2/2] Update zizmor action to version 0.6.2 --- .github/workflows/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index b1465ce..c43565c 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -22,4 +22,4 @@ jobs: persist-credentials: false - name: Run zizmor 🌈 - uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95 # v0.4.1 + uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2