Skip to content

ci: add zizmor #188

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
PierreJeanjacquot merged 2 commits into from
Oct 6, 2026
Merged

ci: add zizmor #188

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
91de90f
ci: add zizmor
PierreJeanjacquot Oct 5, 2026
d0466f0
ci: ignore use-trusted-publishing zizmor finding on rust-build
PierreJeanjacquot Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/workflows/rust-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,4 +93,4 @@ jobs:
- name: Publish to crates.io
if: ${{ inputs.publish-crates-io }}
working-directory: ${{ inputs.working-directory }}
run: cargo publish --locked
run: cargo publish --locked # zizmor: ignore[use-trusted-publishing] TODO fix this if you need to publish on crates.io
47 changes: 47 additions & 0 deletions mise.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 5 additions & 1 deletion mise.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ lockfile = true
[tools]
"aqua:actionlint" = "1.7.12"
"aqua:koalaman/shellcheck" = "0.11.0"
"aqua:zizmor" = "1.30.1"
"npm:prettier" = "3.9.8"

[tasks.format]
Expand Down Expand Up @@ -32,14 +33,17 @@ run = "prettier --check ."
description = "Lint GitHub Actions workflows with actionlint"
run = "actionlint"

[tasks."lint:zizmor"]
run = "zizmor .github"

[tasks."lint:shellcheck"]
description = "Lint shell scripts with shellcheck"
shell = "bash -euo pipefail -c"
run = "git ls-files -z --cached --others --exclude-standard '*.sh' | xargs -0 -r shellcheck"

[tasks.lint]
description = "Run all linters"
depends = [ "lint:format", "lint:actionlint", "lint:shellcheck" ]
depends = [ "lint:format", "lint:actionlint", "lint:shellcheck", "lint:zizmor" ]

[tasks."verify-all"]
description = "Run all lints and checks (as in CI)"
Expand Down
2 changes: 1 addition & 1 deletion rust-build/workflow-sha256
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
d7dda2c72a42adb7818175d14d51fafbe7c2d53ec73119bbacd14ebfab36db60
9c86939ba17005dd0d73804927173e9ac9f3e2abebd93ae4f81d510d654a42e8
Loading