chore(deps): bump the github-actions group across 1 directory with 7 updates #235

	name: zizmor

	permissions: {}

	concurrency:
	group: zizmor-${{ github.ref_name }}
	cancel-in-progress: true

	on:
	push:
	branches:
	- main
	pull_request:
	branches:
	- main
	schedule:
	- cron: "42 18 * * 5"
	workflow_dispatch:

	jobs:
	analyze:
	name: GitHub Actions Security Analysis
	runs-on: ubuntu-latest
	permissions:
	actions: read
	contents: read
	security-events: write

	steps:
	- name: Checkout repository
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Set up just
	uses: ./.github/actions/setup-just # zizmor: ignore[self-repository] actionlint 1.7.12 does not accept $/...

	- name: Resolve zizmor version
	id: zizmor_version
	shell: bash
	run: \|
	set -euo pipefail

	version="$(just --evaluate zizmor_version)"
	if [[ -z "$version" ]]; then
	echo "::error::Could not resolve zizmor_version from justfile"
	exit 1
	fi

	echo "version=$version" >> "$GITHUB_OUTPUT"

	- name: Run zizmor
	uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
	with:
	inputs: .github
	online-audits: true
	persona: regular
	version: ${{ steps.zizmor_version.outputs.version }}

Navigation Menu