name: GitHub Actions Security Analysis
on:
push:
branches:
- main
paths:
- ".github/workflows/**"
- ".github/zizmor.yml"
pull_request:
paths:
- ".github/workflows/**"
- ".github/zizmor.yml"
workflow_dispatch:
permissions: {}
jobs:
zizmor:
name: zizmor
if: github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
steps:
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 with:
persist-credentials: false
- uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa