diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 44b0d17..f494729 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -10,28 +10,16 @@ permissions: {} jobs: zizmor: - name: zizmor latest via PyPI runs-on: ubuntu-latest permissions: security-events: write - contents: read # only needed for private repos - actions: read # only needed for private repos + contents: read # only needed for private or internal repos + actions: read # only needed for private or internal repos steps: - name: Checkout repository uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - - name: Install the latest version of uv - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0 - - name: Run zizmor 🌈 - run: uvx zizmor --format=sarif . > results.sarif - env: - GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - name: Upload SARIF file - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 - with: - sarif_file: results.sarif - category: zizmor + uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7