ci: publish to npm via trusted publishing instead of a stored token #114

	name: GitHub Actions Security Analysis with zizmor

	on:
	push:
	branches: [main]
	paths:
	- .github/workflows/**
	pull_request:
	branches: ["**"]
	paths:
	- .github/workflows/**

	permissions: {}

	jobs:
	zizmor:
	name: Run zizmor
	runs-on: blacksmith-32vcpu-ubuntu-2404
	permissions:
	security-events: write
	contents: read
	actions: read
	steps:
	- name: Checkout repository
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Set up Rust
	uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable

	- name: Install zizmor
	run: cargo install zizmor --version 1.26.1 --locked

	- name: Run zizmor
	run: zizmor --no-exit-codes --format sarif .github/workflows/ > zizmor.sarif
	env:
	GH_TOKEN: ${{ github.token }}

	- name: Upload SARIF
	uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
	with:
	sarif_file: zizmor.sarif

Navigation Menu