Repository navigation

Bump the actions-minor-and-patch group across 1 directory with 8 updates #39

	# Advisory online workflow audits (known-vulnerable-actions, impostor-commit, ref-version-mismatch, stale-action-refs)
	# uploaded to code scanning. Not part of CI / Gate: with advanced-security the action reports through SARIF and does
	# not fail on findings. The blocking, offline zizmor run lives in ci.yml (job lint) and pins the same version.
	name: Workflow security (online)

	on:
	pull_request:
	paths:
	- '.github/**'
	push:
	branches: [ main ]
	schedule:
	- cron: '11 6 * * 1'
	workflow_dispatch:

	concurrency:
	group: ${{ github.workflow }}-${{ github.event.pull_request.number \|\| github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	permissions:
	contents: read

	jobs:
	zizmor:
	name: zizmor (online audits)
	# Fork pull requests get a read-only token and cannot upload SARIF.
	if: github.event_name != 'pull_request' \|\| github.event.pull_request.head.repo.full_name == github.repository
	runs-on: ubuntu-24.04
	timeout-minutes: 10
	permissions:
	contents: read
	security-events: write # upload the SARIF results
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	# Inputs: https://github.com/zizmorcore/zizmor-action (v0.6.4 action.yml).
	- name: Run zizmor
	uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
	with:
	version: 1.30.1
	online-audits: true
	advanced-security: true
	persona: regular
	config: .github/zizmor.yml