silverwind d8c3a1afda ci: pin containers to digest, enable more zizmor rules (#38779) ...

Enable more strict "pedantic" zizmor rules and fix issues. Service
containers are pinned to hash and renovate will update them. Enabled
rules:

- https://docs.zizmor.sh/audits/#excessive-permissions
- https://docs.zizmor.sh/audits/#unpinned-images
- https://docs.zizmor.sh/audits/#template-injection

---------

Signed-off-by: silverwind <me@silverwind.io>

2026-08-06 05:16:07 +00:00

..

cache-prune.yml

ci: pin containers to digest, enable more zizmor rules (#38779)

2026-08-06 05:16:07 +00:00

cache-seeder.yml

ci: pin containers to digest, enable more zizmor rules (#38779)

2026-08-06 05:16:07 +00:00

cron-licenses.yml

ci: pin containers to digest, enable more zizmor rules (#38779)

2026-08-06 05:16:07 +00:00

cron-renovate.yml

chore(deps): update dependencies (#38757)

2026-08-03 21:37:12 +08:00

cron-translations.yml

ci: pin containers to digest, enable more zizmor rules (#38779)

2026-08-06 05:16:07 +00:00

files-changed.yml

refactor: serve the api specs as plain json (#38715)

2026-07-31 14:16:27 +00:00

giteabot-backport.yml

chore(deps): update dependencies (#38757)

2026-08-03 21:37:12 +08:00

giteabot.yml

ci: pin containers to digest, enable more zizmor rules (#38779)

2026-08-06 05:16:07 +00:00

pull-compliance.yml

chore(deps): update dependencies (#38757)

2026-08-03 21:37:12 +08:00

pull-db-tests.yml

ci: pin containers to digest, enable more zizmor rules (#38779)

2026-08-06 05:16:07 +00:00

pull-docker-dryrun.yml

chore(deps): update dependencies (#38660)

2026-07-27 16:55:27 +00:00

pull-e2e-tests.yml

chore(deps): update dependencies (#38660)

2026-07-27 16:55:27 +00:00

pull-labeler.yml

ci: pin containers to digest, enable more zizmor rules (#38779)

2026-08-06 05:16:07 +00:00

release-nightly-snapcraft.yml

ci: pin containers to digest, enable more zizmor rules (#38779)

2026-08-06 05:16:07 +00:00

release-nightly.yml

ci: pin containers to digest, enable more zizmor rules (#38779)

2026-08-06 05:16:07 +00:00

release-tag-rc.yml

ci: pin containers to digest, enable more zizmor rules (#38779)

2026-08-06 05:16:07 +00:00

release-tag-version.yml

ci: pin containers to digest, enable more zizmor rules (#38779)

2026-08-06 05:16:07 +00:00