WIP: A/B updates -- volume based #2151

	# SPDX-FileCopyrightText: 2022-2026 TII (SSRC) and the Ghaf contributors
	#
	# SPDX-License-Identifier: Apache-2.0

	name: GitHub Actions Security Analysis

	on:
	push:
	branches: ["main"]
	pull_request:

	permissions:
	contents: read

	jobs:
	zizmor:
	name: zizmor latest via PyPI
	runs-on: ubuntu-latest
	permissions:
	security-events: write

	steps:
	- name: Harden the runner (Audit all outbound calls)
	uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
	with:
	egress-policy: audit

	- name: Checkout repository
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
	with:
	persist-credentials: false

	- name: Install uv
	uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b

	- name: Run zizmor
	run: uvx zizmor --format=sarif . > results.sarif
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@45cbd0c69e560cd9e7cd7f8c32362050c9b7ded2 # v4.32.2
	with:
	sarif_file: results.sarif
	category: zizmor

Provide feedback