name: Zizmor Actions Scanner

on:
  push:
    branches:
      - main
    paths:
      - '.github/workflows/**'
  pull_request:
    branches:
      - main
    paths:
      - '.github/workflows/**'

permissions:
  contents: read

jobs:
  detect-noop:
    permissions:
      actions: write  # for fkirc/skip-duplicate-actions to skip or stop workflow runs
      contents: read  # for fkirc/skip-duplicate-actions to read and compare commits
    runs-on: ubuntu-latest
    outputs:
      noop: ${{ steps.noop.outputs.should_skip }}
    steps:
      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
        with:
          egress-policy: audit
      - name: Detect No-op Changes
        id: noop
        uses: fkirc/skip-duplicate-actions@b974a9395958c231af965b70070979a577efa578 # v5.3.2
        with:
          github_token: ${{ secrets.GITHUB_TOKEN }}
          paths_ignore: '["**.md", "**.png", "**.jpg"]'
          do_not_skip: '["workflow_dispatch", "schedule", "push"]'
          concurrent_skipping: false

  zizmor:
    name: Run zizmor 🌈
    runs-on: ubuntu-latest
    needs: detect-noop
    if: needs.detect-noop.outputs.noop != 'true'
    permissions:
      security-events: write
    steps:
      - name: Checkout repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          persist-credentials: false

      - name: Run zizmor 🌈
        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
        with:
          inputs: |
            .github/
          token: ${{ github.token }}
          # min-severity: medium
          # min-confidence: medium