ci: release #5604
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: zizmor | |
| # Always runs on PRs so the "Require code scanning results" ruleset rule | |
| # always has a SARIF to inspect. Real analysis only runs when workflow files | |
| # changed; otherwise we upload an empty SARIF so locale-only / code-only PRs | |
| # aren't blocked waiting for a check that never reports. | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| permissions: {} | |
| jobs: | |
| zizmor: | |
| name: Run zizmor | |
| runs-on: ubuntu-latest | |
| permissions: | |
| security-events: write # upload SARIF to code scanning | |
| contents: read | |
| actions: read | |
| pull-requests: read # dorny/paths-filter calls the PRs API on pull_request events | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| persist-credentials: false | |
| - name: Detect workflow changes | |
| id: changes | |
| if: github.event_name == 'pull_request' | |
| uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2 | |
| with: | |
| filters: | | |
| workflows: | |
| - '.github/workflows/**' | |
| - '.github/actions/**' | |
| - '.github/zizmor.yml' | |
| - name: Decide whether to analyze | |
| id: decide | |
| env: | |
| EVENT_NAME: ${{ github.event_name }} | |
| CHANGED: ${{ steps.changes.outputs.workflows }} | |
| run: | | |
| if [ "$EVENT_NAME" != "pull_request" ] || [ "$CHANGED" = "true" ]; then | |
| echo "analyze=true" >> "$GITHUB_OUTPUT" | |
| else | |
| echo "analyze=false" >> "$GITHUB_OUTPUT" | |
| fi | |
| - name: Run zizmor | |
| if: steps.decide.outputs.analyze == 'true' | |
| uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0 | |
| with: | |
| # Pin the tool version (the action defaults to `latest`) so a new | |
| # zizmor release can't surface findings that block unrelated PRs. | |
| version: "1.26.1" | |
| # When skipped, upload an empty SARIF so the ruleset rule passes. | |
| - name: Write empty SARIF | |
| if: steps.decide.outputs.analyze != 'true' | |
| run: | | |
| cat > zizmor.sarif <<'EOF' | |
| { | |
| "version": "2.1.0", | |
| "$schema": "https://json.schemastore.org/sarif-2.1.0.json", | |
| "runs": [ | |
| { | |
| "tool": { | |
| "driver": { | |
| "name": "zizmor", | |
| "semanticVersion": "0.0.0", | |
| "rules": [] | |
| } | |
| }, | |
| "results": [], | |
| "automationDetails": { | |
| "id": "zizmor/" | |
| } | |
| } | |
| ] | |
| } | |
| EOF | |
| - name: Upload empty SARIF | |
| if: steps.decide.outputs.analyze != 'true' | |
| uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 | |
| with: | |
| sarif_file: zizmor.sarif | |
| category: zizmor |