chore(ci): run release verification in-band and record release-proven… #76
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: GitHub Actions Security Analysis with zizmor 🌈 | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - "release/**" | |
| pull_request: | |
| branches: | |
| - main | |
| - "release/**" | |
| workflow_dispatch: | |
| schedule: | |
| - cron: "0 5 * * 1" # Weekly Monday 05:00 UTC — after Scorecard (01:30), release (03:00), CI (Tue 03:00) | |
| permissions: {} | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.head_ref || github.ref }} | |
| cancel-in-progress: true | |
| jobs: | |
| zizmor: | |
| name: Run zizmor 🌈 — auditor · all inputs · fail on any finding | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read # checkout (auditor requires comment) | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run zizmor 🌈 — blocking (plain, no SARIF) | |
| uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 | |
| with: | |
| inputs: "." | |
| collect: all | |
| persona: auditor | |
| min-severity: informational | |
| min-confidence: low | |
| version: "1.29.0" | |
| online-audits: true | |
| advanced-security: false | |
| zizmor-sarif: | |
| name: Run zizmor 🌈 — SARIF upload (non-blocking, triage) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read # checkout / private repo clone | |
| security-events: write # SARIF upload to code scanning | |
| actions: read # upload-sarif workflow metadata (private repos) | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Run zizmor 🌈 — SARIF | |
| uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2 | |
| with: | |
| inputs: "." | |
| collect: all | |
| persona: auditor | |
| min-severity: informational | |
| min-confidence: low | |
| version: "1.29.0" | |
| online-audits: true | |
| advanced-security: true |