[CHORE](ci) Point version-check workflow at MCD CodeArtifact #467

	---
	# Standard Overture Maps Foundation security checks for GitHub Actions workflows.
	#
	# Bundles the following checks:
	# - zizmor: Audits GitHub Actions workflow files for security vulnerabilities
	# using the 'auditor' persona for thorough coverage.
	#
	# Designed to run as a GitHub Ruleset required workflow.
	#
	# SECURITY: This workflow checks out PR branch code for static analysis only.
	# No PR code is executed. Write access is limited to uploading SARIF results
	# to GitHub Advanced Security.
	#
	name: Overture Security Checks

	on: # zizmor: ignore[concurrency-limits]
	pull_request:
	types: [opened, reopened, synchronize]

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:

	zizmor:
	name: zizmor
	runs-on: ubuntu-latest
	permissions:
	contents: read
	actions: read # to read workflow files for security auditing
	security-events: write # to upload SARIF results to GitHub Advanced Security
	steps:
	- name: Checkout
	uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Run zizmor 🌈
	uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
	with:
	persona: pedantic
	advanced-security: false # Use GH PR Annotations instead of uploading SARIF results for better visibility in the PR

Navigation Menu