name: GitHub Actions Security Analysis

on:
  workflow_dispatch:
  pull_request:
    types:
      - opened
      - synchronize
    paths:
      - ".github/workflows/**"
  push:
    branches:
      - main
    paths:
      - ".github/workflows/**"

permissions: {}

jobs:
  zizmor:
    permissions:
      # read workflow runs and history
      actions: read
      # checkout repository contents
      contents: read
      # upload SARIF results to GitHub Security tab
      security-events: write
      # OIDC token for GitHub API authentication
      id-token: write
    uses: luxass/shared-workflows/.github/workflows/reusable-ci-security.yaml@1cee29b38405faf686897dfe9ef5f12416613bc2 # v0.7.2
