name: Zizmor

on:
  push:
    branches: [main]
    paths: [".github/**"]
  pull_request:
    branches: [main]
    paths: [".github/**"]

permissions: {}

concurrency:
  group: zizmor-${{ github.ref }}
  cancel-in-progress: true

# Static security analysis of this app's GitHub Actions workflows
# (template-injection, unpinned actions, excessive token permissions,
# credential persistence). Free runner-hosted SAST — no GitHub Advanced
# Security needed. Findings surface as inline PR annotations. Starts at
# min-severity: high; lower to medium/low once your workflows are clean.

jobs:
  zizmor:
    name: GitHub Actions security (zizmor)
    runs-on: ubuntu-latest
    timeout-minutes: 10
    permissions:
      contents: read
      actions: read
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          persist-credentials: false
      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
        with:
          min-severity: high
          min-confidence: medium
          # This app's repo may not have GitHub Advanced Security; disable the
          # SARIF/code-scanning upload (mutually exclusive with annotations) and
          # surface findings as inline PR annotations instead.
          advanced-security: false
          annotations: true