mirror of
https://github.com/penpot/penpot.git
synced 2026-10-29 14:00:37 +00:00
40 lines
1.5 KiB
YAML
40 lines
1.5 KiB
YAML
# zizmor configuration — https://docs.zizmor.sh/configuration/
|
|
#
|
|
# Every audit is enforced for every workflow. New workflows are checked with
|
|
# no exceptions. The entries below are the only remaining ones, and each is
|
|
# marked as either a pending clean-up or an accepted risk with its reason.
|
|
# Remove a file from a list in the same PR that fixes it, and the whole rule
|
|
# entry once its list is empty.
|
|
rules:
|
|
# Accepted: wrangler is added with `pnpm add wrangler@latest` before each
|
|
# deploy instead of being a dependency of the plugins workspace. Only used
|
|
# to publish to Cloudflare; not worth adding to the workspace.
|
|
adhoc-packages:
|
|
ignore:
|
|
- plugins-deploy-api-doc.yml
|
|
- plugins-deploy-package.yml
|
|
- plugins-deploy-styles-doc.yml
|
|
# Accepted: auto-label.yml needs pull_request_target so the GitHub App
|
|
# secrets are available for PRs from forks. It never checks out or runs
|
|
# PR code, it only reads ids from the event payload.
|
|
dangerous-triggers:
|
|
ignore:
|
|
- auto-label.yml
|
|
# Style nudge towards the `$/...` syntax; not worth enforcing.
|
|
self-repository:
|
|
disable: true
|
|
# Accepted: penpotapp/devenv is our own image, built and pushed by
|
|
# build-docker-devenv.yml, so the floating tag is intentional.
|
|
unpinned-images:
|
|
ignore:
|
|
- plugins-deploy-package.yml
|
|
- tests-backend.yml
|
|
- tests-common.yml
|
|
- tests-e2e.yml
|
|
- tests-exporter.yml
|
|
- tests-frontend.yml
|
|
- tests-library.yml
|
|
- tests-mcp.yml
|
|
- tests-plugins.yml
|
|
- tests-wasm.yml
|