From 2cdd87aaf36e4b272dbe0464afaeb8111a3852bb Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 11:40:00 -0400 Subject: [PATCH 1/3] chore: avoid Renovate validator SHA churn Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/renovate.yml | 2 +- zizmor.yml | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml index 72650e986..2dfca4d58 100644 --- a/.github/workflows/renovate.yml +++ b/.github/workflows/renovate.yml @@ -15,4 +15,4 @@ permissions: jobs: validate: - uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@9c4075a1057c2853a339517fde4063ceccfce861 # main + uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@main diff --git a/zizmor.yml b/zizmor.yml index 39d1b180c..1f1f7d6f5 100644 --- a/zizmor.yml +++ b/zizmor.yml @@ -1,3 +1,8 @@ rules: + unpinned-uses: + config: + policies: + "*": hash-pin + gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml: ref-pin secrets-outside-env: disable: true From be58c3dc45d6763d16501534d23e51e5f8fef777 Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 11:44:11 -0400 Subject: [PATCH 2/3] chore: move zizmor configuration into .github Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- zizmor.yml => .github/zizmor.yml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename zizmor.yml => .github/zizmor.yml (100%) diff --git a/zizmor.yml b/.github/zizmor.yml similarity index 100% rename from zizmor.yml rename to .github/zizmor.yml From 92e92af2a0e90d3c2c59fb91087570e5027053bd Mon Sep 17 00:00:00 2001 From: Adam Setch Date: Thu, 29 Oct 2026 14:37:17 -0400 Subject: [PATCH 3/3] style: format zizmor wildcard policy Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/zizmor.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 1f1f7d6f5..b827b3378 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -2,7 +2,7 @@ rules: unpinned-uses: config: policies: - "*": hash-pin + '*': hash-pin gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml: ref-pin secrets-outside-env: disable: true