# Copyright 2025-2026, Intel Corporation
# SPDX-License-Identifier: BSD-3-Clause

name: GitHub Actions Security Analysis with zizmor

on:
  workflow_dispatch:
  push:
  pull_request:
    paths:
      - '.github/workflows/*'

permissions:
  contents: read

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  zizmor:
    name: Run zizmor
    runs-on: ubuntu-latest
    permissions:
      contents: read # only needed for private repos
      actions: read # only needed for private repos
    steps:
      - name: Checkout repository
        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
        with:
          persist-credentials: false

      - name: Run zizmor
        uses: zizmorcore/zizmor-action@135698455da5c3b3e55f73f4419e481ab68cdd95 # v0.4.1
        with:
          inputs: |
            .github/workflows/
          advanced-security: false
          min-confidence: medium
          min-severity: high
