zizmor (#75)

Signed-off-by: Jan Kowalleck <jan.kowalleck@gmail.com>

Author: jkowalleck

.github/workflows/ruby.yml

@@ -2,9 +2,10 @@ name: Ruby
 
 on:
   push:
-    branches: [ "master", "next" ]
+    branches: [ "master", "main" ]
     tags: [ "v*" ]
   pull_request:
+    branches: ['**']
   workflow_dispatch:
   schedule:
     # schedule dayly tests, since dependencies are not intended to be locked
@@ -82,7 +83,7 @@ jobs:
         ## see https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#example-using-secrets
         if: ${{ env.CODACY_PROJECT_TOKEN != '' }}
         # see https://github.com/codacy/codacy-coverage-reporter-action
-        uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1
+        uses: codacy/codacy-coverage-reporter-action@89d6c85cfafaec52c72b6c5e8b2878d33104c699 # v1.3.0
         with:
           project-token: ${{ env.CODACY_PROJECT_TOKEN }}
           coverage-reports: '${{ env.TESTS_COVERAGE_ARTIFACT }}_*/coverage.xml'

.github/workflows/zizmor.yml

@@ -1,35 +1,31 @@
 name: Zizmor
 
 on:
-  pull_request:
-    paths:
-      - '.github/workflows/**'
-      - '.github/dependabot.yml'
   push:
-    paths:
-      - ".github/workflows/**"
-      - ".github/dependabot.yml"
+    branches: ['master', 'main']
+  pull_request:
+    branches: ['**']
+  workflow_dispatch:
   schedule:
-    # weekly scan: every Saturday at 00:00 UTC
     - cron: '0 0 * * 6'
 
+permissions: {}
+
 concurrency:
   group: '${{ github.workflow }}-${{ github.ref }}'
   cancel-in-progress: true
 
-permissions: {}
-
 jobs:
   zizmor:
-    name: Harden GitHub Workflows (zizmor)
+    name: Zizmor
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
       contents: read
     steps:
       - name: Checkout
         # see https://github.com/actions/checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Run zizmor 🌈