Add zizmor CI & make it happy (#32717)

* Add zizmor CI & make it happy Signed-off-by: Michael Telatynski <7t3chguy@gmail.com> * Fix zizmor job Signed-off-by: Michael Telatynski <7t3chguy@gmail.com> --------- Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>
2026-03-09 16:52:04 +00:00
parent 095b407dae
commit 2e0adc5832
25 changed files with 79 additions and 23 deletions
@@ -1,13 +1,15 @@
 name: Pull Request
 on:
-    pull_request_target:
+    # Privilege escalation necessary access members of the review teams
+    # 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
        types: [opened, edited, labeled, unlabeled, synchronize]
    merge_group:
        types: [checks_requested]
 permissions: {}
 jobs:
    action:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop # zizmor: ignore[unpinned-uses]
        permissions:
            pull-requests: write
        secrets: