supabase/zizmor.yml at create-pull-request/patch - supabase - Gitea: 个人代码仓库

lywsvip/supabase

mirror of https://github.com/supabase/supabase.git synced 2026-09-06 09:59:03 +08:00

Files

Charis da724eb8c6 ci: add zizmor lint and harden GitHub Actions workflows (#47895 )

## Summary
- Add a zizmor config and CI job that lints `.github/workflows` on every
PR touching it, downloading and attestation-verifying the pinned v1.26.1
release binary (cached across runs)
- Fix the mutable-tag and excess-permission findings zizmor surfaces in
`braintrust-evals.yml`, `publish_image.yml`, and
`self-host-tests-smoke.yml`: pin `actions/checkout`/`actions/setup-node`
to commit SHAs, and scope `pull-requests`/`packages`/`id-token`
permissions down to the specific jobs that need them

## Test plan
- [x] Confirm the `zizmor` job runs and passes on this PR

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **New Features**
* Added automated security scanning for workflow changes on pull
requests.
  * Added configuration to allow specific workflow trigger exceptions.

* **Security**
* Tightened GitHub Actions permissions at the workflow level and
re-granted only where required per job.
* Pinned common build action versions to specific commits for more
consistent execution.

* **Maintenance**
* Updated workflow caching and action step annotations without changing
linting or fixing behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

2026-07-13 16:57:44 -04:00

9 lines

207 B

YAML

Raw Permalink Blame History

 rules:
   dangerous-triggers:
     ignore:
       - "authorize-vercel-deploys.yml"
       - "docs-lint-v2-comment.yml"
       - "external-pr-comment.yml"
       - "label_prs.yml"
       - "studio-master-alert.yml"