From 27314c9fb00c3b364d762a93653cf7d793d41cd4 Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Sun, 2 Aug 2026 19:50:40 +0200 Subject: [PATCH] chore(zizmor): drop the local policy copy, the reusable supplies it netresearch/.github#339 makes the zizmor reusable fetch the organisation policy at run time when a repo has no .github/zizmor.yml of its own, and removes the file from the templates. Keeping a copy here would silently win over the shared policy the next time it really changes, which is how this file came to differ across the fleet in the first place. The scan itself is unchanged: the same policy is applied, from one place. Signed-off-by: Sebastian Mendel --- .github/zizmor.yml | 14 -------------- 1 file changed, 14 deletions(-) delete mode 100644 .github/zizmor.yml diff --git a/.github/zizmor.yml b/.github/zizmor.yml deleted file mode 100644 index 5ba7884..0000000 --- a/.github/zizmor.yml +++ /dev/null @@ -1,14 +0,0 @@ -# zizmor (https://zizmor.sh) configuration -# -# Tunes zizmor to Netresearch conventions so the audit reports only -# actionable findings. Third-party actions remain hash-pin enforced. -rules: - unpinned-uses: - config: - policies: - # First-party `uses:` — reusable workflows AND composite actions — - # track @main by policy and are never SHA-pinned, so a fix propagates - # to every consumer without a bump in dozens of repos. - "netresearch/*": ref-pin - # Everything else must be pinned to a full commit SHA. - "*": hash-pin