From 1be0f5ee4f409b82a2409c0e112c11529b78af20 Mon Sep 17 00:00:00 2001 From: Altay Date: Tue, 18 Aug 2026 06:49:33 +0300 Subject: [PATCH] feat: let callers pass extra zizmor arguments Co-Authored-By: Claude Fable 5 --- .github/workflows/scan.yml | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml index 2daf1f4..91f536f 100644 --- a/.github/workflows/scan.yml +++ b/.github/workflows/scan.yml @@ -10,6 +10,15 @@ name: Scan on: workflow_call: + inputs: + zizmor-args: + description: >- + Extra zizmor arguments for repositories with documented needs, + e.g. --no-online-audits when a workflow pins a private first-party + action whose tags the repository token cannot list. + type: string + required: false + default: "" permissions: contents: read @@ -73,7 +82,9 @@ jobs: - name: Audit workflow security env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} + ZIZMOR_EXTRA_ARGS: ${{ inputs.zizmor-args }} run: | + # $ZIZMOR_EXTRA_ARGS word-splits by design; it carries flags, not data. docker run --rm -e GH_TOKEN -v "$PWD:/repo" \ ghcr.io/zizmorcore/zizmor@sha256:863026d54f91271b10b60b67ad8054cb37120167e162482597db102b3026a284 \ - /repo # 1.29.0 + $ZIZMOR_EXTRA_ARGS /repo # 1.29.0