mirror of
https://github.com/rsyslog/rsyslog.git
synced 2026-06-16 00:42:40 +02:00
aa76d1e25e
Why: GitHub Actions security findings should fail CI before new workflow changes can regress the hardening work. Impact: Workflow-related pull requests now run zizmor against all GitHub Actions workflows. Dependabot can update the pinned zizmor package version. Before/After: Before, zizmor was only run manually; after, workflow changes have a dedicated CI security audit. Technical Overview: Add a path-scoped zizmor check workflow for workflow-file changes and manual dispatch. Install zizmor from a pinned requirements file inside a local virtualenv so the runner's system Python packaging policy does not affect the job. Run zizmor with strict collection and GitHub Actions annotation output against the complete .github/workflows directory. Add a Dependabot pip entry for .github so zizmor version updates can be proposed automatically without making the CI install unpinned. With the help of AI-Agents: Codex
32 lines
575 B
YAML
32 lines
575 B
YAML
---
|
|
version: 2
|
|
updates:
|
|
- package-ecosystem: "github-actions"
|
|
directory: "/"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
github-actions:
|
|
patterns:
|
|
- "*"
|
|
labels:
|
|
- "CI"
|
|
- "cleanup"
|
|
commit-message:
|
|
prefix: "ci"
|
|
- package-ecosystem: "pip"
|
|
directory: "/.github"
|
|
schedule:
|
|
interval: "weekly"
|
|
open-pull-requests-limit: 5
|
|
groups:
|
|
python-ci:
|
|
patterns:
|
|
- "*"
|
|
labels:
|
|
- "CI"
|
|
- "cleanup"
|
|
commit-message:
|
|
prefix: "ci"
|