Skip to content

Commit ff2810d

Browse files
committed
CI: Add zizmor job
1 parent 46d3ee6 commit ff2810d

File tree

1 file changed

+28
-0
lines changed

1 file changed

+28
-0
lines changed

.github/workflows/ci.yml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,16 @@ jobs:
7171
with:
7272
files: Cargo.lock
7373

74+
- uses: tj-actions/changed-files@6cb76d07bee4c9772c6882c06c37837bf82a04d3 # v46.0.4
75+
id: changed-files-ci
76+
with:
77+
files: .github/workflows/**
78+
7479
outputs:
7580
non-js: ${{ steps.changed-files-non-js.outputs.any_modified }}
7681
non-rust: ${{ steps.changed-files-non-rust.outputs.any_modified }}
7782
rust-lockfile: ${{ steps.changed-files-rust-lockfile.outputs.any_modified }}
83+
ci: ${{ steps.changed-files-ci.outputs.any_modified }}
7884

7985
percy-nonce:
8086
name: Frontend / Percy Nonce
@@ -302,3 +308,25 @@ jobs:
302308
name: playwright-report
303309
path: playwright-report/
304310
retention-days: 14
311+
312+
zizmor:
313+
name: CI / Lint
314+
runs-on: ubuntu-24.04
315+
needs: changed-files
316+
if: needs.changed-files.outputs.ci == 'true'
317+
permissions:
318+
security-events: write
319+
steps:
320+
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
321+
with:
322+
persist-credentials: false
323+
324+
- uses: astral-sh/setup-uv@6b9c6063abd6010835644d4c2e1bef4cf5cd0fca # v6.0.1
325+
- run: uvx zizmor --format=sarif . > results.sarif
326+
env:
327+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
328+
329+
- uses: github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
330+
with:
331+
sarif_file: results.sarif
332+
category: zizmor

0 commit comments

Comments
 (0)