From 3cfe7514298c0b4404c43896b6511849a31f0637 Mon Sep 17 00:00:00 2001 From: EmmanuelNiyonshuti Date: Mon, 27 Jul 2026 08:17:07 +0200 Subject: [PATCH 1/5] add zizmor as gh action --- .github/workflows/zizmor.yml | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml new file mode 100644 index 0000000000..6385aefd5a --- /dev/null +++ b/.github/workflows/zizmor.yml @@ -0,0 +1,24 @@ +name: GitHub Actions Security Analysis with zizmor 🌈 + +on: + push: + branches: ["main"] + pull_request: + branches: ["**"] + +permissions: {} + +jobs: + zizmor: + name: Run zizmor 🌈 + runs-on: ubuntu-latest + permissions: + security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files. + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 From be3cd04028f84aa5aa9b4387ec060d5ba2402018 Mon Sep 17 00:00:00 2001 From: EmmanuelNiyonshuti Date: Mon, 27 Jul 2026 09:01:27 +0200 Subject: [PATCH 2/5] remove zizmor from pre-commit --- .pre-commit-config.yaml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml index 02790c6fd2..c844d80888 100644 --- a/.pre-commit-config.yaml +++ b/.pre-commit-config.yaml @@ -45,10 +45,6 @@ repos: rev: v1.0.2 hooks: - id: sphinx-lint - - repo: https://github.com/woodruffw/zizmor-pre-commit - rev: v1.28.0 - hooks: - - id: zizmor - repo: local hooks: - id: regenerate-files From 7c68bb54fa4c875c6351f2e2d66bf1df25f3d069 Mon Sep 17 00:00:00 2001 From: EmmanuelNiyonshuti Date: Mon, 27 Jul 2026 10:23:53 +0200 Subject: [PATCH 3/5] make zizmor gha a reusable workflow --- .github/workflows/ci.yml | 7 +++++++ .github/workflows/zizmor.yml | 5 +---- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 9f250211a3..2e584a0f9b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -470,6 +470,12 @@ jobs: flags: Cython,${{ steps.get-version.outputs.version }} fail_ci_if_error: true + zizmor: + name: zizmor + permissions: + security-events: write + uses: ./.github/workflows/zizmor.yml + # https://github.com/marketplace/actions/alls-green#why check: # This job does nothing and is only used for the branch protection @@ -482,6 +488,7 @@ jobs: - macOS - Alpine - Cython + - zizmor runs-on: ubuntu-latest diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml index 6385aefd5a..eb03b51427 100644 --- a/.github/workflows/zizmor.yml +++ b/.github/workflows/zizmor.yml @@ -1,10 +1,7 @@ name: GitHub Actions Security Analysis with zizmor 🌈 on: - push: - branches: ["main"] - pull_request: - branches: ["**"] + workflow_call: permissions: {} From 57915ecdd03a87e62b8e6c26a9686ddf82f9447a Mon Sep 17 00:00:00 2001 From: EmmanuelNiyonshuti Date: Mon, 27 Jul 2026 15:55:51 +0200 Subject: [PATCH 4/5] add zizmor directly in ci.yml and remove separate file --- .github/workflows/ci.yml | 14 +++++++++++--- .github/workflows/zizmor.yml | 21 --------------------- 2 files changed, 11 insertions(+), 24 deletions(-) delete mode 100644 .github/workflows/zizmor.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2e584a0f9b..b31633e7e5 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -471,10 +471,18 @@ jobs: fail_ci_if_error: true zizmor: - name: zizmor + name: Run zizmor 🌈 + runs-on: ubuntu-latest permissions: - security-events: write - uses: ./.github/workflows/zizmor.yml + security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files. + steps: + - name: Checkout repository + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 # https://github.com/marketplace/actions/alls-green#why check: # This job does nothing and is only used for the branch protection diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml deleted file mode 100644 index eb03b51427..0000000000 --- a/.github/workflows/zizmor.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: GitHub Actions Security Analysis with zizmor 🌈 - -on: - workflow_call: - -permissions: {} - -jobs: - zizmor: - name: Run zizmor 🌈 - runs-on: ubuntu-latest - permissions: - security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files. - steps: - - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - persist-credentials: false - - - name: Run zizmor 🌈 - uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 From 02cca49e09bfd92616d6428cbab971d38f94288d Mon Sep 17 00:00:00 2001 From: EmmanuelNiyonshuti Date: Mon, 27 Jul 2026 17:27:45 +0200 Subject: [PATCH 5/5] drop SHA pins for now --- .github/workflows/ci.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index b31633e7e5..ef26a0b2bb 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -477,12 +477,12 @@ jobs: security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files. steps: - name: Checkout repository - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + uses: actions/checkout@v7 with: persist-credentials: false - name: Run zizmor 🌈 - uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1 + uses: zizmorcore/zizmor-action@v0.6.1 # https://github.com/marketplace/actions/alls-green#why check: # This job does nothing and is only used for the branch protection