Use zizmor to lint GitHub action workflows
Martin Weinelt committed
Apr 6, 2025 at 16:14 UTC
205b1ecd331cf916254b8a0f3017d80f69051329
1 file changed
+43
.github/workflows/zizmor.yml
new
+43
@@ -0,0 +1,43 @@
1
+name: GitHub Actions Security Analysis with zizmor 🌈
2
+
3
+on:
4
+ push:
5
+ branches:
6
+ - main
7
+ paths:
8
+ - ".github/**"
9
+ - flake.lock
10
+ pull_request:
11
+ paths:
12
+ - ".github/**"
13
+ - flake.lock
14
+
15
+permissions: {}
16
+
17
+jobs:
18
+ zizmor:
19
+ name: Run zizmor against GitHub Action workflows
20
+ runs-on: ubuntu-latest
21
+ permissions:
22
+ security-events: write
23
+ steps:
24
+ - name: Clone repository
25
+ uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
26
+ with:
27
+ persist-credentials: false
28
+
29
+ - name: Install nix
30
+ uses: cachix/install-nix-action@d1ca217b388ee87b2507a9a93bf01368bde7cec2 # v31
31
+
32
+ - name: Run zizmor 🌈
33
+ env:
34
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
35
+ run: |
36
+ nix run --inputs-from . nixpkgs-unstable#zizmor -- \
37
+ --format sarif --pedantic . > results.sarif
38
+
39
+ - name: Upload SARIF file
40
+ uses: github/codeql-action/upload-sarif@1b549b9259bda1cb5ddde3b41741a82a2d15a841 # v3
41
+ with:
42
+ sarif_file: results.sarif
43
+ category: zizmor