# zizmor configuration — https://docs.zizmor.sh/configuration/
#
# Every audit is enforced for every workflow. New workflows are checked with
# no exceptions. The entries below are the only remaining ones, and each is
# marked as either a pending clean-up or an accepted risk with its reason.
# Remove a file from a list in the same PR that fixes it, and the whole rule
# entry once its list is empty.
rules:
  # Accepted: wrangler is added with `pnpm add wrangler@latest` before each
  # deploy instead of being a dependency of the plugins workspace. Only used
  # to publish to Cloudflare; not worth adding to the workspace.
  adhoc-packages:
    ignore:
      - plugins-deploy-api-doc.yml
      - plugins-deploy-package.yml
      - plugins-deploy-styles-doc.yml
  # Accepted: auto-label.yml needs pull_request_target so the GitHub App
  # secrets are available for PRs from forks. It never checks out or runs
  # PR code, it only reads ids from the event payload.
  dangerous-triggers:
    ignore:
      - auto-label.yml
  # Style nudge towards the `$/...` syntax; not worth enforcing.
  self-repository:
    disable: true
  # Accepted: penpotapp/devenv is our own image, built and pushed by
  # build-docker-devenv.yml, so the floating tag is intentional.
  unpinned-images:
    ignore:
      - plugins-deploy-package.yml
      - tests-backend.yml
      - tests-common.yml
      - tests-e2e.yml
      - tests-exporter.yml
      - tests-frontend.yml
      - tests-library.yml
      - tests-mcp.yml
      - tests-plugins.yml
      - tests-wasm.yml