From bda36e4a9cc22b77477402deb549437990ca8813 Mon Sep 17 00:00:00 2001 From: Peter Pathirana Date: Wed, 19 Aug 2026 19:17:55 +0000 Subject: [PATCH] ci(github-actions): add zizmor gate to lint workflow Mirrors the zizmor job homelab-ops-terraform already runs, so workflow-file changes here get the same static-analysis/security gate as the rest of the org instead of being lint-checked ad hoc. --- .github/workflows/lint.yaml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml index 5346ed15..dea420e7 100644 --- a/.github/workflows/lint.yaml +++ b/.github/workflows/lint.yaml @@ -143,3 +143,10 @@ jobs: with: git_ref: ${{ github.head_ref || github.ref }} files: ${{ github.event_name != 'pull_request' && 'ALL' || fromJSON(needs.detect-changes.outputs.results).yaml_all_changed_files }} + + zizmor: + needs: [detect-changes] + if: ${{ github.event_name != 'pull_request' || fromJSON(needs.detect-changes.outputs.results).actions_any_changed == 'true' }} + uses: ppat/github-workflows/.github/workflows/lint-zizmor.yaml@1e8ca1b00b6e69bdf5aef8b33111c594c051ff65 # v4.4.0 + with: + git_ref: ${{ github.head_ref || github.ref }}