build(deps): bump zizmor-action to 0.6.3 and disable the audit the bump breaks #127

	name: codeql

	on:
	# No push: trigger. CI-CD-STANDARD.md 11e — the pull_request run below
	# already analysed this exact commit, so re-running CodeQL on the merge
	# to main pays for the same analysis twice. The weekly schedule keeps the
	# default-branch alert baseline fresh when no PR has landed.
	pull_request:
	schedule:
	- cron: "17 3 * * 1"

	permissions:
	contents: read

	concurrency:
	group: codeql-${{ github.ref }}
	cancel-in-progress: ${{ github.event_name == 'pull_request' }}

	jobs:
	analyze:
	name: CodeQL
	runs-on: ubuntu-latest
	timeout-minutes: 30
	permissions:
	contents: read
	security-events: write

	steps:
	- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
	with:
	persist-credentials: false

	- name: Initialize CodeQL
	uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
	with:
	languages: actions
	build-mode: none

	- name: Perform CodeQL analysis
	uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
	with:
	category: "/language:actions"

Navigation Menu