chore: lint gh actions with zizmor (#4062)

Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com>
2026-10-30 22:12:28 +01:00 · 2025-07-16 17:12:38 -04:00
parent 37c182d5be
commit 9cda2de2ad
13 changed files with 126 additions and 13 deletions
@@ -0,0 +1,11 @@
+rules:
+  unpinned-uses:
+    ignore:
+      # Allow unpinned uses of trusted internal anchore/workflows actions
+      - update-anchore-dependencies.yml
+
+  dangerous-triggers:
+    ignore:
+      # Safe use of pull_request_target - only runs trusted scripts from base repo,
+      # never checks out PR code, needs secrets for labeling PRs from forks
+      - detect-schema-changes.yaml