mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 05:50:35 +00:00
214cbbf678
The job only reads commit messages, which works with the pull_request trigger for PRs from forks too. Running it on both triggers checked every PR twice, once with a privileged token it does not need. Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
44 lines
1.4 KiB
YAML
44 lines
1.4 KiB
YAML
# zizmor configuration — https://docs.zizmor.sh/configuration/
|
|
#
|
|
# Every audit is enforced for every workflow. The per-file ignores below are
|
|
# the findings that already existed when this check was introduced: each one
|
|
# is a pending clean-up, not an accepted risk. New workflows are checked
|
|
# with no exceptions. Remove a file from a list in the same PR that fixes it,
|
|
# and the whole rule entry once its list is empty.
|
|
rules:
|
|
# Avoid installing packages ad hoc inside `run:`.
|
|
adhoc-packages:
|
|
ignore:
|
|
- plugins-deploy-api-doc.yml
|
|
- plugins-deploy-package.yml
|
|
- plugins-deploy-styles-doc.yml
|
|
# Avoid restoring caches in release/publish workflows.
|
|
cache-poisoning:
|
|
ignore:
|
|
- plugins-deploy-api-doc.yml
|
|
- plugins-deploy-styles-doc.yml
|
|
# Review `pull_request_target` usage.
|
|
dangerous-triggers:
|
|
ignore:
|
|
- auto-label.yml
|
|
# Scope GitHub App tokens.
|
|
github-app:
|
|
ignore:
|
|
- auto-label.yml
|
|
# Style nudge towards the `$/...` syntax; not worth enforcing.
|
|
self-repository:
|
|
disable: true
|
|
# Pin container images to a digest.
|
|
unpinned-images:
|
|
ignore:
|
|
- plugins-deploy-package.yml
|
|
- tests-backend.yml
|
|
- tests-common.yml
|
|
- tests-e2e.yml
|
|
- tests-exporter.yml
|
|
- tests-frontend.yml
|
|
- tests-library.yml
|
|
- tests-mcp.yml
|
|
- tests-plugins.yml
|
|
- tests-wasm.yml
|