From ce082bb7d5a1d7bef396b390e66a75d6b62bd70e Mon Sep 17 00:00:00 2001
From: Andy Rae <1127507+AndyRae@users.noreply.github.com>
Date: Wed, 12 Aug 2026 09:14:20 +0100
Subject: [PATCH 1/6] chore: Add zizmor

---
 .github/workflows/zizmor.yml | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..3322ae3
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,25 @@
+name: GitHub Actions Security Analysis
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+

From 5ce22a2964a18e7cbbd5efcb4335c9af12e87dcd Mon Sep 17 00:00:00 2001
From: Andy Rae <1127507+AndyRae@users.noreply.github.com>
Date: Wed, 12 Aug 2026 10:26:58 +0100
Subject: [PATCH 2/6] Add zizmor caller

---
 .github/workflows/zizmor-caller.yml | 14 ++++++++++++++
 .github/workflows/zizmor.yml        |  7 ++-----
 2 files changed, 16 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/zizmor-caller.yml

diff --git a/.github/workflows/zizmor-caller.yml b/.github/workflows/zizmor-caller.yml
new file mode 100644
index 0000000..711c1c8
--- /dev/null
+++ b/.github/workflows/zizmor-caller.yml
@@ -0,0 +1,14 @@
+name: Github Workflows Security Analysis (Zizmor) (self)
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  dependency-review:
+    uses: ./.github/workflows/zizmor.yml
+    secrets: inherit
+
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 3322ae3..61a356b 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -1,10 +1,7 @@
-name: GitHub Actions Security Analysis
+name: GitHub Actions Security Analysis (zizmor)
 
 on:
-  push:
-    branches: ["main"]
-  pull_request:
-    branches: ["**"]
+  workflow_call
 
 permissions: {}
 

From 8ebbe55ebb8d6b8d2fcf5432222bf30d0843b71e Mon Sep 17 00:00:00 2001
From: Andy Rae <1127507+AndyRae@users.noreply.github.com>
Date: Wed, 12 Aug 2026 10:43:14 +0100
Subject: [PATCH 3/6] Add security permissions

---
 .github/workflows/zizmor-caller.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/zizmor-caller.yml b/.github/workflows/zizmor-caller.yml
index 711c1c8..7265635 100644
--- a/.github/workflows/zizmor-caller.yml
+++ b/.github/workflows/zizmor-caller.yml
@@ -6,6 +6,7 @@ on:
 permissions:
   contents: read
   packages: read
+  security-events: write
 
 jobs:
   dependency-review:

From 9fbf8496ec03f6174aa71baa0d98411f71923b80 Mon Sep 17 00:00:00 2001
From: Andy Rae <1127507+AndyRae@users.noreply.github.com>
Date: Wed, 12 Aug 2026 14:10:40 +0100
Subject: [PATCH 4/6] Remove permissions

---
 .github/workflows/zizmor-caller.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor-caller.yml b/.github/workflows/zizmor-caller.yml
index 7265635..8801c57 100644
--- a/.github/workflows/zizmor-caller.yml
+++ b/.github/workflows/zizmor-caller.yml
@@ -6,10 +6,10 @@ on:
 permissions:
   contents: read
   packages: read
-  security-events: write
 
 jobs:
   dependency-review:
     uses: ./.github/workflows/zizmor.yml
+    security-events: write
     secrets: inherit
 

From d5ecc40a2588458eb47acb8ab500e78e35d090f2 Mon Sep 17 00:00:00 2001
From: Andy Rae <1127507+AndyRae@users.noreply.github.com>
Date: Wed, 12 Aug 2026 15:58:36 +0100
Subject: [PATCH 5/6] Update zizmor

---
 .github/workflows/zizmor-caller.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor-caller.yml b/.github/workflows/zizmor-caller.yml
index 8801c57..fa7a422 100644
--- a/.github/workflows/zizmor-caller.yml
+++ b/.github/workflows/zizmor-caller.yml
@@ -10,6 +10,7 @@ permissions:
 jobs:
   dependency-review:
     uses: ./.github/workflows/zizmor.yml
-    security-events: write
+    permissions:
+      security-events: write
     secrets: inherit
 

From 33167af402b5c1cea88903c9a6c5d14d5ee33b5f Mon Sep 17 00:00:00 2001
From: Andy Rae <1127507+AndyRae@users.noreply.github.com>
Date: Wed, 12 Aug 2026 16:00:34 +0100
Subject: [PATCH 6/6] Update zizmor

---
 .github/workflows/zizmor-caller.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/zizmor-caller.yml b/.github/workflows/zizmor-caller.yml
index fa7a422..5358696 100644
--- a/.github/workflows/zizmor-caller.yml
+++ b/.github/workflows/zizmor-caller.yml
@@ -12,5 +12,4 @@ jobs:
     uses: ./.github/workflows/zizmor.yml
     permissions:
       security-events: write
-    secrets: inherit