From ff5a2c53524305f9ecf44784358e7fcfd65d0f8b Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Sat, 1 Aug 2026 10:37:45 +0200 Subject: [PATCH] ci: add zizmor workflow SAST from the updated template Adds the standalone zizmor.yml (GitHub Actions static analysis, report-only SARIF to code scanning) that the netresearch/.github go template now carries, so it runs here now rather than at the next template sync. Signed-off-by: Sebastian Mendel --- .github/workflows/zizmor.yml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000..ad292c8 --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,21 @@ +name: Zizmor + +# Static analysis of the repo's GitHub Actions workflows (https://zizmor.sh). +# Report-only: the reusable runs in SARIF mode (exit 0 regardless of findings) +# and uploads results to the Security / code-scanning tab, like CodeQL and +# Scorecard. Findings surface as alerts; they never fail CI. + +on: + push: + branches: [main] + pull_request: + branches: [main] + +permissions: {} + +jobs: + zizmor: + uses: netresearch/.github/.github/workflows/zizmor.yml@main + permissions: + contents: read + security-events: write