3dab060bfa
Bumps the github-actions group with 6 updates in the / directory: | Package | From | To | | --- | --- | --- | | [actions/cache](https://github.com/actions/cache) | `4.2.4` | `4.3.0` | | [docker/login-action](https://github.com/docker/login-action) | `3.5.0` | `3.6.0` | | [actions/upload-artifact](https://github.com/actions/upload-artifact) | `4.6.2` | `5.0.0` | | [actions/setup-node](https://github.com/actions/setup-node) | `5.0.0` | `6.0.0` | | [astral-sh/setup-uv](https://github.com/astral-sh/setup-uv) | `6.7.0` | `7.1.2` | | [github/codeql-action](https://github.com/github/codeql-action) | `3.30.3` | `4.31.0` | Updates `actions/cache` from 4.2.4 to 4.3.0 - [Release notes](https://github.com/actions/cache/releases) - [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md) - [Commits](0400d5f644...0057852bfa) Updates `docker/login-action` from 3.5.0 to 3.6.0 - [Release notes](https://github.com/docker/login-action/releases) - [Commits](184bdaa072...5e57cd1181) Updates `actions/upload-artifact` from 4.6.2 to 5.0.0 - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](ea165f8d65...330a01c490) Updates `actions/setup-node` from 5.0.0 to 6.0.0 - [Release notes](https://github.com/actions/setup-node/releases) - [Commits](a0853c2454...2028fbc5c2) Updates `astral-sh/setup-uv` from 6.7.0 to 7.1.2 - [Release notes](https://github.com/astral-sh/setup-uv/releases) - [Commits](b75a909f75...85856786d1) Updates `github/codeql-action` from 3.30.3 to 4.31.0 - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](192325c861...4e94bd11f7) --- updated-dependencies: - dependency-name: actions/cache dependency-version: 4.3.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: docker/login-action dependency-version: 3.6.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: github-actions - dependency-name: actions/upload-artifact dependency-version: 5.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: actions/setup-node dependency-version: 6.0.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: astral-sh/setup-uv dependency-version: 7.1.2 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions - dependency-name: github/codeql-action dependency-version: 4.31.0 dependency-type: direct:production update-type: version-update:semver-major dependency-group: github-actions ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
35 lines
938 B
YAML
35 lines
938 B
YAML
name: zizmor
|
|
|
|
on:
|
|
push:
|
|
paths:
|
|
- '.github/workflows/*.ya?ml'
|
|
pull_request:
|
|
paths:
|
|
- '.github/workflows/*.ya?ml'
|
|
|
|
jobs:
|
|
zizmor:
|
|
name: zizmor latest via PyPI
|
|
runs-on: ubuntu-24.04
|
|
permissions:
|
|
security-events: write
|
|
steps:
|
|
- name: Checkout repository
|
|
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
|
|
with:
|
|
persist-credentials: false
|
|
|
|
- name: Install the latest version of uv
|
|
uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v7.1.2
|
|
|
|
- name: Run zizmor 🌈
|
|
run: uvx zizmor --format sarif . > results.sarif
|
|
env:
|
|
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
|
|
|
- name: Upload SARIF file
|
|
uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v4.31.0
|
|
with:
|
|
sarif_file: results.sarif
|
|
category: zizmor
|