name: GitHub Actions Security Analysis

on:
  push:
    branches: [main]
  pull_request:
    branches:
      - main
      - "litellm_**"

concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
  cancel-in-progress: true

permissions: {}

jobs:
  zizmor:
    name: zizmor
    runs-on: ubuntu-latest
    timeout-minutes: 5
    permissions:
      contents: read
    steps:
      - name: Checkout repository
        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4.3.0
        with:
          persist-credentials: false

      - name: Install zizmor
        run: |
          curl -fsSL --retry 3 -o "$RUNNER_TEMP/zizmor.tar.gz" \
            https://github.com/zizmorcore/zizmor/releases/download/v1.31.1/zizmor-x86_64-unknown-linux-gnu.tar.gz
          echo "d185f726bdaf92df78273217dfdd24ebcd6b0ef48cf3ce776ff5762b6e138c99  $RUNNER_TEMP/zizmor.tar.gz" | sha256sum -c -
          tar xzf "$RUNNER_TEMP/zizmor.tar.gz" -C "$RUNNER_TEMP" zizmor

      - name: Run zizmor
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          "$RUNNER_TEMP/zizmor" --no-ignores --no-config --min-severity=medium --format=github .