name: GitHub Actions Security Analysis with zizmor 🌈

on:

  push:

    branches: ["main"]

  pull_request:

    branches: ["**"]

permissions: {}

jobs:

  zizmor:

    name: zizmor latest via PyPI

    runs-on: ubuntu-latest

    permissions:

      security-events: write

    steps:

      - name: Checkout repository

        uses: actions/checkout@v6

        with:

          persist-credentials: false

      - name: Install the latest version of uv

        uses: astral-sh/setup-uv@v7

      - name: Run zizmor 🌈

        run: uvx zizmor --format sarif . > results.sarif

        env:

          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Upload SARIF file

        uses: github/codeql-action/upload-sarif@v4

        with:

          sarif_file: results.sarif

          category: zizmor