jazzband -> django-commons updates #40

	name: Zizmor

	on:
	push:
	branches: [ main ]
	pull_request:
	paths:
	- ".github/workflows/*/.yml"
	schedule:
	# Run weekly
	- cron: '0 0 * * 0'
	workflow_dispatch:

	permissions:
	contents: read

	jobs:
	zizmor-analysis:
	name: Run Zizmor
	runs-on: ubuntu-latest
	permissions:
	contents: read
	security-events: write

	steps:
	- name: Checkout repository
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
	with:
	persist-credentials: false

	- name: Set up Rust
	uses: actions-rust-lang/setup-rust-toolchain@150fca883cd4034361b621bd4e6a9d34e5143606
	- name: Install jq
	run: \|
	sudo apt-get update
	sudo apt-get install -y jq
	- name: Install Zizmor
	run: \|
	cargo install --locked zizmor

	- name: Run Zizmor analysis
	run: \|
	zizmor --format sarif .github/workflows/ > zizmor.sarif

	- name: Upload analysis results
	uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
	with:
	name: zizmor-results
	path: zizmor.sarif
	retention-days: 7

	- name: Upload to code-scanning
	uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13
	with:
	sarif_file: zizmor.sarif

	- name: Fail on Findings
	run: \|
	count="$(
	jq '([.runs[]? \| (.results // [])[] \| select(.level != "note")] \| length) // 0' \
	zizmor.sarif
	)"
	echo "Zizmor findings: $count"
	test "$count" -eq 0

Provide feedback