Commit Graph

3 Commits

Author SHA1 Message Date
Daniel Hast
ed767a6a69 ci: ignore known Zizmor findings
This avoids false positives from existing uses of `GITHUB_ENV` and
`pull_request_target` that are safe, as well as from cache usage in a
workflow that doesn't produce release artifacts.
2026-03-09 21:40:50 -04:00
Daniel Hast
3572bf7e16 ci: eliminate template expansion in code contexts
Replace all template expansions in code contexts with environment
variable substitutions. Template expansion in code contexts can be a
source of code injection vulnerabilities; for more info, see:
https://docs.zizmor.sh/audits/#template-injection
2026-03-09 21:40:39 -04:00
dundargoc
ce6fefbab9 ci: create setup action
This deduplicates common operations.
2023-12-01 16:59:23 +01:00