From 5ecb82e3f959531a02a7ffea64454663e9309741 Mon Sep 17 00:00:00 2001
From: andrewg-mira <89816284+andrewg-mira@users.noreply.github.com>
Date: Tue, 20 Oct 2026 09:40:04 -0700
Subject: [PATCH 1/5] DEVOPS-1129 initial: combine zizmor workflows

---
 .github/workflows/reusable-zizmor.yml | 48 +++++++++++++++++++++++++++
 .github/workflows/security_scan.yml   | 15 ++-------
 2 files changed, 51 insertions(+), 12 deletions(-)
 create mode 100644 .github/workflows/reusable-zizmor.yml

diff --git a/.github/workflows/reusable-zizmor.yml b/.github/workflows/reusable-zizmor.yml
new file mode 100644
index 00000000..eac68756
--- /dev/null
+++ b/.github/workflows/reusable-zizmor.yml
@@ -0,0 +1,48 @@
+name: Zizmor analysis
+
+on:
+  workflow_call:
+    inputs:
+      min_severity:
+        description: "Minimum severity: informational|low|medium|high"
+        required: false
+        default: medium
+        type: string
+      min_confidence:
+        description: "Minimum confidence: low|medium|high"
+        required: false
+        default: low
+        type: string
+      persona:
+        description: "Audit persona: regular|pedantic|auditor"
+        required: false
+        default: regular
+        type: string
+jobs:
+  zizmor:
+    name: Security Scan
+    if: ${{ (github.event_name != 'pull_request') || (github.event.pull_request.draft == false) }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+      checks: write
+      security-events: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
+
+      - name: Setup Zizmor Config
+        uses: $/.github/actions/setup-zizmor-config
+
+      - name: Run Zizmor Security Scan
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: ${{ github.event_name != 'pull_request' }}
+          annotations: ${{ github.event_name == 'pull_request' }}
+          persona: ${{ inputs.persona }}
+          min-severity: ${{ inputs.min_severity }}
+          min-confidence: ${{ inputs.min_confidence }}
diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml
index e34f49c2..ce33faf2 100644
--- a/.github/workflows/security_scan.yml
+++ b/.github/workflows/security_scan.yml
@@ -24,20 +24,11 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  call-workflow-zizmor-annotate:
-    name: Zizmor analysis (advanced security)
-    if: ${{ github.event_name != 'pull_request' }}
+  zizmor:
+    name: Zizmor analysis
     permissions:
       security-events: write
-      contents: read
-      actions: read
-    uses: ./.github/workflows/reusable-zizmor-advanced-security.yml
-
-  call-workflow-zizmor-advanced-security:
-    name: Zizmor analysis (annotate)
-    if: ${{ github.event_name == 'pull_request' }}
-    permissions:
       checks: write
       contents: read
       actions: read
-    uses: ./.github/workflows/reusable-zizmor-annotate.yml
+    uses: ./.github/workflows/reusable-zizmor.yml

From 2807e3d2a18d15957bda9f4e58f8c95b049ce090 Mon Sep 17 00:00:00 2001
From: andrewg-mira <89816284+andrewg-mira@users.noreply.github.com>
Date: Wed, 28 Oct 2026 11:49:48 -0700
Subject: [PATCH 2/5] DEVOPS-1129 add parameters for 'annotations' and
 'advanced_security'

---
 .github/workflows/reusable-zizmor.yml | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/reusable-zizmor.yml b/.github/workflows/reusable-zizmor.yml
index eac68756..d2308981 100644
--- a/.github/workflows/reusable-zizmor.yml
+++ b/.github/workflows/reusable-zizmor.yml
@@ -18,6 +18,17 @@ on:
         required: false
         default: regular
         type: string
+      annotations:
+        description: "Force annotation of workflow files (default: enabled on pull requests or private repos)"
+        required: false
+        default: false
+        type: boolean
+      advanced_security:
+        description: "Force upload to GitHub Advanced Security (default: enabled on non-PR events in public repos)"
+        required: false
+        default: false
+        type: boolean
+
 jobs:
   zizmor:
     name: Security Scan
@@ -41,8 +52,8 @@ jobs:
       - name: Run Zizmor Security Scan
         uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
-          advanced-security: ${{ github.event_name != 'pull_request' }}
-          annotations: ${{ github.event_name == 'pull_request' }}
+          advanced-security: ${{ inputs.advanced_security || (github.event_name != 'pull_request' && github.event.repository.visibility == 'public') }}
+          annotations: ${{ inputs.annotations || (github.event_name == 'pull_request' || github.event.repository.visibility == 'private') }}
           persona: ${{ inputs.persona }}
           min-severity: ${{ inputs.min_severity }}
           min-confidence: ${{ inputs.min_confidence }}

From 1117679089a331cf335f366aa589378b62dee8e9 Mon Sep 17 00:00:00 2001
From: andrewg-mira <89816284+andrewg-mira@users.noreply.github.com>
Date: Wed, 28 Oct 2026 12:41:15 -0700
Subject: [PATCH 3/5] DEVOPS-1129 remove old zizmor workflows

---
 .../reusable-zizmor-advanced-security.yml     | 48 -------------------
 .../workflows/reusable-zizmor-annotate.yml    | 48 -------------------
 .../workflows/reusable-zizmor-security.yml    | 47 ------------------
 3 files changed, 143 deletions(-)
 delete mode 100644 .github/workflows/reusable-zizmor-advanced-security.yml
 delete mode 100644 .github/workflows/reusable-zizmor-annotate.yml
 delete mode 100644 .github/workflows/reusable-zizmor-security.yml

diff --git a/.github/workflows/reusable-zizmor-advanced-security.yml b/.github/workflows/reusable-zizmor-advanced-security.yml
deleted file mode 100644
index 7de18fc0..00000000
--- a/.github/workflows/reusable-zizmor-advanced-security.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-name: Zizmor analysis
-
-on:
-  workflow_call:
-    inputs:
-      min_severity:
-        description: "Minimum severity: informational|low|medium|high"
-        required: false
-        default: medium
-        type: string
-      min_confidence:
-        description: "Minimum confidence: low|medium|high"
-        required: false
-        default: low
-        type: string
-      persona:
-        description: "Audit persona: regular|pedantic|auditor"
-        required: false
-        default: regular
-        type: string
-
-jobs:
-  zizmor:
-    name: Security Scan
-    if: ${{ (github.event_name != 'pull_request') || (github.event.pull_request.draft == false) }}
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      contents: read
-      actions: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          persist-credentials: false
-
-      - name: Setup Zizmor Config
-        uses: $/.github/actions/setup-zizmor-config
-
-      - name: Run Zizmor Security Scan
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
-        with:
-          advanced-security: true
-          annotations: false
-          persona: ${{ inputs.persona }}
-          min-severity: ${{ inputs.min_severity }}
-          min-confidence: ${{ inputs.min_confidence }}
diff --git a/.github/workflows/reusable-zizmor-annotate.yml b/.github/workflows/reusable-zizmor-annotate.yml
deleted file mode 100644
index 39dc7965..00000000
--- a/.github/workflows/reusable-zizmor-annotate.yml
+++ /dev/null
@@ -1,48 +0,0 @@
-name: Zizmor analysis
-
-on:
-  workflow_call:
-    inputs:
-      min_severity:
-        description: "Minimum severity: informational|low|medium|high"
-        required: false
-        default: medium
-        type: string
-      min_confidence:
-        description: "Minimum confidence: low|medium|high"
-        required: false
-        default: low
-        type: string
-      persona:
-        description: "Audit persona: regular|pedantic|auditor"
-        required: false
-        default: regular
-        type: string
-
-jobs:
-  zizmor:
-    name: Security Scan
-    if: ${{ (github.event_name != 'pull_request') || (github.event.pull_request.draft == false) }}
-    runs-on: ubuntu-latest
-    permissions:
-      checks: write
-      contents: read
-      actions: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          persist-credentials: false
-
-      - name: Setup Zizmor Config
-        uses: $/.github/actions/setup-zizmor-config
-
-      - name: Run Zizmor Security Scan
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
-        with:
-          advanced-security: false
-          annotations: true
-          persona: ${{ inputs.persona }}
-          min-severity: ${{ inputs.min_severity }}
-          min-confidence: ${{ inputs.min_confidence }}
diff --git a/.github/workflows/reusable-zizmor-security.yml b/.github/workflows/reusable-zizmor-security.yml
deleted file mode 100644
index 73d5f46c..00000000
--- a/.github/workflows/reusable-zizmor-security.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-name: Zizmor analysis
-
-on:
-  workflow_call:
-    inputs:
-      min_severity:
-        description: "Minimum severity: informational|low|medium|high"
-        required: false
-        default: medium
-        type: string
-      min_confidence:
-        description: "Minimum confidence: low|medium|high"
-        required: false
-        default: low
-        type: string
-      persona:
-        description: "Audit persona: regular|pedantic|auditor"
-        required: false
-        default: regular
-        type: string
-
-jobs:
-  zizmor:
-    name: Security Scan
-    if: ${{ (github.event_name != 'pull_request') || (github.event.pull_request.draft == false) }}
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          persist-credentials: false
-
-      - name: Setup Zizmor Config
-        uses: $/.github/actions/setup-zizmor-config
-
-      - name: Run Zizmor Security Scan
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
-        with:
-          advanced-security: false
-          annotations: false
-          persona: ${{ inputs.persona }}
-          min-severity: ${{ inputs.min_severity }}
-          min-confidence: ${{ inputs.min_confidence }}

From eceb9c61e828472e2fb6ed526e82502f288a8969 Mon Sep 17 00:00:00 2001
From: andrewg-mira <89816284+andrewg-mira@users.noreply.github.com>
Date: Wed, 28 Oct 2026 13:32:00 -0700
Subject: [PATCH 4/5] DEVOPS-1129 remove 'checks: write' permission form zizmor
 workflows

---
 .github/workflows/reusable-zizmor.yml | 1 -
 .github/workflows/security_scan.yml   | 1 -
 2 files changed, 2 deletions(-)

diff --git a/.github/workflows/reusable-zizmor.yml b/.github/workflows/reusable-zizmor.yml
index d2308981..7b76b58f 100644
--- a/.github/workflows/reusable-zizmor.yml
+++ b/.github/workflows/reusable-zizmor.yml
@@ -37,7 +37,6 @@ jobs:
     permissions:
       contents: read
       actions: read
-      checks: write
       security-events: write
 
     steps:
diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml
index ce33faf2..b783e8be 100644
--- a/.github/workflows/security_scan.yml
+++ b/.github/workflows/security_scan.yml
@@ -28,7 +28,6 @@ jobs:
     name: Zizmor analysis
     permissions:
       security-events: write
-      checks: write
       contents: read
       actions: read
     uses: ./.github/workflows/reusable-zizmor.yml

From 061d2a6425c7ad0e2f49f446e9ed132ca43eef17 Mon Sep 17 00:00:00 2001
From: andrewg-mira <89816284+andrewg-mira@users.noreply.github.com>
Date: Thu, 29 Oct 2026 10:23:26 -0700
Subject: [PATCH 5/5] DEVOPS-1129 remove annotations, advanced_security zizmor
 inputs

---
 .github/workflows/reusable-zizmor.yml | 14 ++------------
 1 file changed, 2 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/reusable-zizmor.yml b/.github/workflows/reusable-zizmor.yml
index 7b76b58f..5e877089 100644
--- a/.github/workflows/reusable-zizmor.yml
+++ b/.github/workflows/reusable-zizmor.yml
@@ -18,16 +18,6 @@ on:
         required: false
         default: regular
         type: string
-      annotations:
-        description: "Force annotation of workflow files (default: enabled on pull requests or private repos)"
-        required: false
-        default: false
-        type: boolean
-      advanced_security:
-        description: "Force upload to GitHub Advanced Security (default: enabled on non-PR events in public repos)"
-        required: false
-        default: false
-        type: boolean
 
 jobs:
   zizmor:
@@ -51,8 +41,8 @@ jobs:
       - name: Run Zizmor Security Scan
         uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
-          advanced-security: ${{ inputs.advanced_security || (github.event_name != 'pull_request' && github.event.repository.visibility == 'public') }}
-          annotations: ${{ inputs.annotations || (github.event_name == 'pull_request' || github.event.repository.visibility == 'private') }}
+          advanced-security: ${{ github.event_name != 'pull_request' && github.event.repository.visibility == 'public' }}
+          annotations: ${{ github.event_name == 'pull_request' || github.event.repository.visibility == 'private' }}
           persona: ${{ inputs.persona }}
           min-severity: ${{ inputs.min_severity }}
           min-confidence: ${{ inputs.min_confidence }}