name: Zizmor
on:
    push:
    pull_request:
    schedule:
        - cron: "0 12 * * 1" # Monday, 12:00:00 UTC
    workflow_dispatch:

permissions: {}

jobs:
    zizmor:
        name: Action Static Analysis
        runs-on: ubuntu-latest
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

        steps:
            - name: Checkout repository
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  persist-credentials: false

            - name: Install uv
              uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0

            - name: Run zizmor
              run: uvx zizmor .
