Skip to content

README.md

Latest commit

 

History

History
44 lines (34 loc) · 1.14 KB

README.md

File metadata and controls

44 lines (34 loc) · 1.14 KB
Raw

Zizmor

Reusable GitHub Actions workflow that runs zizmor against the calling repository's GitHub Actions workflows and uploads the SARIF results to the repository's code scanning dashboard.

How to use

Add a workflow file to your repository (for example .github/workflows/zizmor.yml):

name: Zizmor

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '45 9 * * 5'
  workflow_dispatch:

permissions: {}

jobs:
  zizmor:
    permissions:
      contents: read
      security-events: write # for zizmor to upload SARIF results
    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@<sha-or-tag>

Pin <sha-or-tag> to a commit SHA or release tag in this repository. No secrets are required. The workflow uses zizmor's regular persona by default.

To use a different persona, pass the persona input:

jobs:
  zizmor:
    permissions:
      contents: read
      security-events: write # for zizmor to upload SARIF results
    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@<sha-or-tag>
    with:
      persona: pedantic