File tree Expand file tree Collapse file tree 1 file changed +28
-0
lines changed Expand file tree Collapse file tree 1 file changed +28
-0
lines changed Original file line number Diff line number Diff line change @@ -71,10 +71,16 @@ jobs:
71
71
with :
72
72
files : Cargo.lock
73
73
74
+ - uses : tj-actions/changed-files@6cb76d07bee4c9772c6882c06c37837bf82a04d3 # v46.0.4
75
+ id : changed-files-ci
76
+ with :
77
+ files : .github/workflows/**
78
+
74
79
outputs :
75
80
non-js : ${{ steps.changed-files-non-js.outputs.any_modified }}
76
81
non-rust : ${{ steps.changed-files-non-rust.outputs.any_modified }}
77
82
rust-lockfile : ${{ steps.changed-files-rust-lockfile.outputs.any_modified }}
83
+ ci : ${{ steps.changed-files-ci.outputs.any_modified }}
78
84
79
85
percy-nonce :
80
86
name : Frontend / Percy Nonce
@@ -302,3 +308,25 @@ jobs:
302
308
name : playwright-report
303
309
path : playwright-report/
304
310
retention-days : 14
311
+
312
+ zizmor :
313
+ name : CI / Lint
314
+ runs-on : ubuntu-24.04
315
+ needs : changed-files
316
+ if : needs.changed-files.outputs.ci == 'true'
317
+ permissions :
318
+ security-events : write
319
+ steps :
320
+ - uses : actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
321
+ with :
322
+ persist-credentials : false
323
+
324
+ - uses : astral-sh/setup-uv@6b9c6063abd6010835644d4c2e1bef4cf5cd0fca # v6.0.1
325
+ - run : uvx zizmor --format=sarif . > results.sarif
326
+ env :
327
+ GH_TOKEN : ${{ secrets.GITHUB_TOKEN }}
328
+
329
+ - uses : github/codeql-action/upload-sarif@ff0a06e83cb2de871e5a09832bc6a81e7276941f # v3.28.18
330
+ with :
331
+ sarif_file : results.sarif
332
+ category : zizmor
You can’t perform that action at this time.
0 commit comments