From 58f94b0cc1c7bcbd9fc50e40f1d3d212028c3b95 Mon Sep 17 00:00:00 2001
From: Mike Dalessio <mike@37signals.com>
Date: Tue, 17 Mar 2026 17:37:41 -0400
Subject: [PATCH] ci: add job to lint github actions

using zizmor
---
 .github/workflows/ci-checks.yml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci-checks.yml b/.github/workflows/ci-checks.yml
index d77d763df..220b1763b 100644
--- a/.github/workflows/ci-checks.yml
+++ b/.github/workflows/ci-checks.yml
@@ -45,7 +45,6 @@ jobs:
       - name: Brakeman audit
         run: bin/brakeman --quiet --no-pager --exit-on-warn --exit-on-error
 
-
   lint:
     name: Lint
     runs-on: ubuntu-latest
@@ -61,3 +60,17 @@ jobs:
 
       - name: Lint code for consistent style
         run: bin/rubocop
+
+  zizmor:
+    name: GitHub Actions audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        with:
+          advanced-security: false