Skip to content

🔒️ Add zizmor and fix audit findings#1705

Open
YuriiMotov wants to merge 21 commits intomasterfrom
setup-zizmor
Open

🔒️ Add zizmor and fix audit findings#1705
YuriiMotov wants to merge 21 commits intomasterfrom
setup-zizmor

Conversation

@YuriiMotov
Copy link
Copy Markdown
Member

Changes applied:

  • Setup daily interval and 7 days cooldown period for Dependabot
  • Added pre-commit package ecosystem to Dependabot config
  • Ignored dangerous-triggers rule for pull_request_target and workflow_run (checked that they are used in a safe way)
  • Specified minimal permissions on workflow level, moved permissions to the job level
  • Ignored secrets-outside-env rule as using the environments would require approval for each run (and without required approvals it wouldn't make sense)
  • Added persist-credentials: false for actions/checkout when persisting is not needed by other steps
  • Specified version of uv to install for astral-sh/setup-uv (Note that Dependabot will not upgrade it, but Renovate can do it)
  • Specified run condition in latest-changes to make it clear that it only runs for merged PRs
  • Replaced uvx prek command with uv run prek - uvx uses latest version (unpinned), it's better to use locked version
  • Added zizmor pre-commit hook
  • Added zizmor workflow to check on push to master (pre-commit hook will only work if workflow files updated by PR)

@github-actions github-actions Bot added the conflicts Automatically generated when a PR has a merge conflict label Apr 17, 2026
@github-actions
Copy link
Copy Markdown
Contributor

This pull request has a merge conflict that needs to be resolved.

@github-actions github-actions Bot removed the conflicts Automatically generated when a PR has a merge conflict label Apr 20, 2026
@YuriiMotov YuriiMotov marked this pull request as ready for review April 20, 2026 10:22
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 20, 2026

📝 Docs preview

Last commit 677003b at: https://723bade7.typertiangolo.pages.dev

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants