What the developer wrote
Authored by Jose Storopoli
ci: add cron-zizmor job
What changed, and why it matters
This commit adds a new scheduled GitHub Actions workflow that runs an automated security scanner called zizmor against the repository's CI/CD configuration every day. It does not change any application code, fix a bug, or introduce a vulnerability. It is purely a defensive security monitoring addition.
No action required; this is a security-hardening/monitoring change. Reviewers may want to confirm the zizmor SARIF upload destination and ensure the workflow's security-events: write permission is acceptable for the project's threat model.
Security signals we found
Adds defensive CI security scanning (zizmor) for GitHub Actions workflows
Uses minimal job permissions (security-events: write only)
Disables persistent checkout credentials (persist-credentials: false)
Pinned third-party action versions with SHA comments
Evidence from the diff
The commit introduces .github/workflows/cron-zizmor.yml, a cron-triggered workflow that runs zizmor (a static analysis tool for GitHub Actions security issues) daily at midnight UTC. It uses uv to install/execute zizmor, produces SARIF output, and uploads the results to GitHub’s code scanning dashboard. The workflow follows least-privilege permissions (no top-level permissions, job-level security-events: write only) and checks out code with persist-credentials: false.
Changed components
.github/workflows/cron-zizmor.ymlInspect captured patch +33 / −0
diff --git a/.github/workflows/cron-zizmor.yml b/.github/workflows/cron-zizmor.yml
new file mode 100644
index 00000000..8d70f3fe
--- /dev/null
+++ b/.github/workflows/cron-zizmor.yml
@@ -0,0 +1,33 @@
+name: Automated GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+ schedule:
+ - cron: "0 0 * * *" # Run every day at midnight
+
+permissions: {}
+
+jobs:
+ zizmor:
+ name: zizmor latest via PyPI
+ runs-on: ubuntu-latest
+ permissions:
+ security-events: write
+ steps:
+ - name: Checkout repository
+ uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v4
+ with:
+ persist-credentials: false
+
+ - name: Install the latest version of uv
+ uses: astral-sh/setup-uv@85856786d1ce8acfbcc2f13a5f3fbd6b938f9f41 # v5
+
+ - name: Run zizmor 🌈
+ run: uvx zizmor --format sarif . > results.sarif
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+ - name: Upload SARIF file
+ uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3
+ with:
+ sarif_file: results.sarif
+ category: zizmor
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.