name: GitHub Actions Security Analysis

on:

push:

branches:

- master

pull_request:

permissions: {}

jobs:

zizmor:

name: Security Analysis with zizmor

runs-on: ubuntu-latest

permissions:

contents: read

security-events: write

steps:

- name: Checkout repository

uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

with:

persist-credentials: false

- name: Install the latest version of uv

uses: astral-sh/setup-uv@bd01e18f51369d5a26f1651c3cb451d3417e3bba # v6.3.1

- name: Run zizmor

run: uvx zizmor --persona=pedantic --format sarif . > results.sarif

env:

GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

- name: Upload SARIF file

uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b # v3.29.2

with:

sarif_file: results.sarif

category: zizmor