From 103565d34d0ac480dc0aa5ad13b94e310edc310e Mon Sep 17 00:00:00 2001
From: "updatecli-neuvector[bot]"
 <316951767+updatecli-neuvector[bot]@users.noreply.github.com>
Date: Sat, 15 Aug 2026 12:48:35 +0000
Subject: [PATCH 1/4] chore(zizmor): install zizmor configuration file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Made with ❤️️ by updatecli
---
 .github/zizmor.yaml | 4 ++++
 1 file changed, 4 insertions(+)
 create mode 100644 .github/zizmor.yaml

diff --git a/.github/zizmor.yaml b/.github/zizmor.yaml
new file mode 100644
index 0000000..b8d3aef
--- /dev/null
+++ b/.github/zizmor.yaml
@@ -0,0 +1,4 @@
+
+rules:
+    secrets-outside-env:
+        disable: true

From 0aee5732cd8ff9fb535d9904ab08ba6a915decf6 Mon Sep 17 00:00:00 2001
From: "updatecli-neuvector[bot]"
 <316951767+updatecli-neuvector[bot]@users.noreply.github.com>
Date: Sat, 15 Aug 2026 12:48:36 +0000
Subject: [PATCH 2/4] chore(zizmor): install Zizmor gha action v0.6.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Made with ❤️️ by updatecli
---
 .github/workflows/zizmor.yaml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 .github/workflows/zizmor.yaml

diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
new file mode 100644
index 0000000..a91bd0d
--- /dev/null
+++ b/.github/workflows/zizmor.yaml
@@ -0,0 +1,27 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          # intentionally not scanning the entire repository,
+          inputs: ./.github/
+          advanced-security: true

From 375eabd9dc5f7dff66847612a9419741b9800e96 Mon Sep 17 00:00:00 2001
From: "updatecli-neuvector[bot]"
 <316951767+updatecli-neuvector[bot]@users.noreply.github.com>
Date: Mon, 31 Aug 2026 02:30:39 +0000
Subject: [PATCH 3/4] chore(zizmor): install Zizmor gha action v0.6.3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Made with ❤️️ by updatecli
---
 .github/workflows/zizmor.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index a91bd0d..146e82c 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
         with:
           # intentionally not scanning the entire repository,
           inputs: ./.github/

From f1b70dd8831cb30ae275d9b9be792dc6c45b821b Mon Sep 17 00:00:00 2001
From: "updatecli-neuvector[bot]"
 <316951767+updatecli-neuvector[bot]@users.noreply.github.com>
Date: Thu, 10 Sep 2026 02:54:24 +0000
Subject: [PATCH 4/4] chore(zizmor): install Zizmor gha action v0.6.4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Made with ❤️️ by updatecli
---
 .github/workflows/zizmor.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 146e82c..8341e2c 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           # intentionally not scanning the entire repository,
           inputs: ./.github/