From 77b6b00543d58a90d2516d33dfec8e495d753c2c Mon Sep 17 00:00:00 2001 From: Samuel Giddins Date: Fri, 20 Dec 2024 11:24:20 -0800 Subject: [PATCH] Add zizmor lint job To catch github actions mis-configurations Signed-off-by: Samuel Giddins --- .github/workflows/lint.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index ae98b7cf767..f3a3d2d9f0a 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -94,3 +94,31 @@ jobs: fail_on_unpinned: true open_pr: false repo_root: "." + zizmor: + name: zizmor + runs-on: ubuntu-latest + permissions: + security-events: write + # required for workflows in private repositories + contents: read + actions: read + steps: + - name: Checkout repository + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 + with: + persist-credentials: false + + - name: Install the latest version of uv + uses: astral-sh/setup-uv@180f8b44399608a850e1db031fa65c77746566d3 # v5.0.1 + + - name: Run zizmor 🌈 + run: uvx zizmor --format sarif . > results.sarif + + env: + GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + + - name: Upload SARIF file + uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3.27.9 + with: + sarif_file: results.sarif + category: zizmor