potiuk opened a new pull request, #72: URL: https://github.com/apache/comdev-events-site/pull/72
Adds [zizmor](https://docs.zizmor.sh/) as a CI check over `.github/`, so GitHub Actions security problems (script injection, unpinned actions, over-broad permissions, credential persistence) get caught in review rather than after the fact. ### What's here - **`.github/workflows/zizmor.yml`** — runs `uvx zizmor@latest` over the repo on pushes to `main` that touch `.github/`, on PRs that touch `.github/`, and on `workflow_dispatch`. Findings are reported as annotations on the offending workflow lines and fail the job. The workflow itself is clean: `contents: read` only, `persist-credentials: false`, and both actions pinned to commit SHAs. - **`.github/zizmor.yml`** — config waiving the one finding that is intentional: `artipacked` on `getcalendar.yml`, which deliberately reuses the credentials persisted by `actions/checkout` to push the refreshed calendar data back to the branch. - **`.github/workflows/getcalendar.yml`** — pins `actions/checkout` to a commit SHA (v4.4.0) and comments why the persisted credentials are needed there. Dependabot (added in #70) will keep the pinned SHAs current. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01RtqKBTSR2jQF7xhHMBpdoy -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
