From 30b56a4420f83da16d9a363c45338c673e49e39d Mon Sep 17 00:00:00 2001
From: Steve Beattie <steve.beattie@chainguard.dev>
Date: Thu, 9 Apr 2026 15:49:53 -0700
Subject: [PATCH] chore(workflows): add github action linters [SECINT-75]

Signed-off-by: Steve Beattie <steve.beattie@chainguard.dev>
---
 .github/workflows/zizmor.yaml | 44 +++++++++++++++++++++++++++++++++++
 .github/zizmor.yml            |  9 +++++++
 2 files changed, 53 insertions(+)
 create mode 100644 .github/workflows/zizmor.yaml
 create mode 100644 .github/zizmor.yml

diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
new file mode 100644
index 0000000..44390ec
--- /dev/null
+++ b/.github/workflows/zizmor.yaml
@@ -0,0 +1,44 @@
+# Copyright 2026 Chainguard, Inc.
+# SPDX-License-Identifier: Apache-2.0
+
+name: Zizmor
+
+on:
+  pull_request:
+    branches: ['main']
+    paths:
+      - '.github/workflows/**'
+      - '.github/actions/**'
+  push:
+    branches: ['main']
+    paths:
+      - '.github/workflows/**'
+      - '.github/actions/**'
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read # Required by codeql-action/upload-sarif to get workflow run info
+      contents: read # Clone the repository
+      security-events: write # Upload SARIF results to Code Scanning
+    steps:
+      - uses: step-security/harden-runner@fe104658747b27e96e4f7e80cd0a94068e53901d # v2.16.1
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
+            pkg-containers.githubusercontent.com:443
+            ghcr.io
+
+      - name: Check out code
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..0812a03
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,9 @@
+# Copyright 2026 Chainguard, Inc.
+# SPDX-License-Identifier: Apache-2.0
+#
+rules:
+  # adjust the default cooldown for non-security dependabot updates
+  # to 3 days, down from 7.
+  dependabot-cooldown:
+    config:
+      days: 3