Merge pull request #23 from render-engine/issue-22

Author: brass75

.github/workflows/main.yml

@@ -7,7 +7,6 @@ on:
   repository_dispatch:
 
 permissions:
-  id-token: write # This is required for requesting the JWT
   contents: read # This is required for actions/checkout
 
 concurrency:
@@ -38,14 +37,16 @@ jobs:
       url: https://render-engine.org
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      id-token: write # This is required for requesting the JWT
     if: github.ref == 'refs/heads/main'
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: website
           path: ./output
       - name: Upload
-        uses: teahouse-hosting/upload@trunk
+        uses: teahouse-hosting/upload@trunk # zizmor: ignore[unpinned-uses]
         with:
           domain: render-engine.org
           root: ./output/

.github/workflows/zizmor.yml

@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read         # Only needed for private repos. Needed to clone the repo.
+      actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4