Description
zizmor is a static analyzer for enforcing security best practices in GitHub Actions actions and workflows.
See @gforsyth 's excellent write-up in #390 for details on the types of things it can catch.
We should use it in pre-commit here
Benefits of this work
- improves security for these workflows
Acceptance Criteria
zizmor is required to pass for CI to pass here
Approach
Add zizmor to .pre-commit-config.yaml and fix whatever it warns about (or suppress false positives with configuration). Follow #390 as an example
Add a small workflow running pre-commit on PRs here.
Update branch rulesets to require that workflow to succeed for PRs to be merged.
Notes
N/A
Description
zizmoris a static analyzer for enforcing security best practices in GitHub Actions actions and workflows.See @gforsyth 's excellent write-up in #390 for details on the types of things it can catch.
We should use it in
pre-commithereBenefits of this work
Acceptance Criteria
zizmoris required to pass for CI to pass hereApproach
Add
zizmorto.pre-commit-config.yamland fix whatever it warns about (or suppress false positives with configuration). Follow #390 as an exampleAdd a small workflow running
pre-commiton PRs here.Update branch rulesets to require that workflow to succeed for PRs to be merged.
Notes
N/A