Skip to content

CI: move zizmor to pre-commit - #269

Open
reakaleek wants to merge 2 commits into
mainfrom
cursor/ad42399b
Open

CI: move zizmor to pre-commit#269
reakaleek wants to merge 2 commits into
mainfrom
cursor/ad42399b

Conversation

@reakaleek

Copy link
Copy Markdown
Member

What

  • Add the official zizmor-pre-commit hook to .pre-commit-config.yaml.
  • Remove the standalone zizmor.yml GitHub Actions workflow.

Why

  • zizmor now runs the same way as actionlint: as a pre-commit hook, enforced on PRs by the existing pre-commit job.
  • This lets contributors catch GitHub Actions security issues locally, before pushing, instead of only in CI.

Notes

  • .github/zizmor.yml is unchanged. zizmor discovers it automatically, no --config flag needed.
  • The PR check name changes from Run zizmor to the umbrella pre-commit job. If branch protection requires the old check name, update required checks after merge.

Made with Cursor

Run zizmor through the zizmor-pre-commit hook instead of a dedicated
GitHub Actions workflow. This gives us local pre-commit coverage and
keeps PR checks in the existing pre-commit job, matching how
actionlint is already wired up.

Co-authored-by: Cursor <cursoragent@cursor.com>
@reakaleek
reakaleek requested a review from a team as a code owner August 5, 2026 19:39
@reakaleek
reakaleek requested a review from Mpdreamz August 5, 2026 19:39
@reakaleek reakaleek self-assigned this Aug 5, 2026

@Mpdreamz Mpdreamz left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we keep the workflow as well? At some point this will be a company wide checklist and it's nice to have a paper trail on this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants