Jefffrey opened a new issue, #26408: URL: https://github.com/apache/datafusion/issues/26408
### Is your feature request related to a problem or challenge? > zizmor is a static analysis tool for your CI/CD. > > It can find and fix security issues in common CI/CD setups, including GitHub Actions, Dependabot, and pre-commit. - https://docs.zizmor.sh/ For reference, iceberg also uses it: - https://github.com/apache/iceberg/issues/15742 - https://github.com/apache/iceberg/blob/2cf68d951533659dd18ccdfa6501d925ecd52d02/.github/workflows/zizmor.yml ### Describe the solution you'd like Use zizmor to audit our github actions; fix any issues it finds, before integrating it as an automated workflow like codeql. Keep in mind some of what it flags may not be easy to fix (e.g. will flag any `issue_comment` and `workflow_run` triggers) so some consideration needs to be made between fixing issues and putting an ignore on them since solution might be difficult - aka dont just blindly apply all fixes ### Describe alternatives you've considered _No response_ ### Additional context _No response_ ### Willingness to contribute None -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
