Add zizmor CI & make it happy (#32717)

* Add zizmor CI & make it happy Signed-off-by: Michael Telatynski <7t3chguy@gmail.com> * Fix zizmor job Signed-off-by: Michael Telatynski <7t3chguy@gmail.com> --------- Signed-off-by: Michael Telatynski <7t3chguy@gmail.com>
2026-03-09 16:52:04 +00:00
parent 095b407dae
commit 2e0adc5832
25 changed files with 79 additions and 23 deletions
@@ -49,6 +49,8 @@ jobs:
        runs-on: ubuntu-24.04
        steps:
            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false

            - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
            - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -73,6 +75,19 @@ jobs:
              run: git diff --exit-code
              if: matrix.assert-diff

+    zizmor:
+        name: Zizmor Github Actions lint
+        runs-on: ubuntu-24.04
+        permissions:
+            security-events: write
+        steps:
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
+
+            - name: Run zizmor
+              uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
+
    i18n:
        strategy:
            fail-fast: false
@@ -95,7 +110,7 @@ jobs:
                    - name: Shared Components
                      path: "packages/shared-components"
        name: "i18n Check (${{ matrix.name }})"
-        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@abf186831e2acb3e98fca13a0711a3fa1364d2b1
        permissions:
            pull-requests: read
        with: