From ce84b4547a1006bd254b1c338c2f7de0ccb00310 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 2 Sep 2026 23:48:40 +0000
Subject: [PATCH 1/2] chore(deps): update zizmorcore/zizmor-action action to
 v0.6.3

---
 .github/workflows/ci-security.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci-security.yaml b/.github/workflows/ci-security.yaml
index fb95f69..54ebd0f 100644
--- a/.github/workflows/ci-security.yaml
+++ b/.github/workflows/ci-security.yaml
@@ -24,6 +24,6 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
         with:
           advanced-security: false

From a0aa0e20c5b47134f58276e161d7e541f7311e5a Mon Sep 17 00:00:00 2001
From: Max Mehl <max.mehl@deutschebahn.com>
Date: Thu, 3 Sep 2026 15:35:38 +0200
Subject: [PATCH 2/2] ci: apply new local github workflow best practice
 (zizmor)

---
 .github/workflows/selftest.yaml | 8 ++++----
 .github/workflows/test.yaml     | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/selftest.yaml b/.github/workflows/selftest.yaml
index fddddf5..18f52e4 100644
--- a/.github/workflows/selftest.yaml
+++ b/.github/workflows/selftest.yaml
@@ -25,7 +25,7 @@ jobs:
       - name: Install syft
         run: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b ~/.local/bin
       - name: Install compliance-assistant
-        uses: ./.github/actions/uvbuild
+        uses: $/.github/actions/uvbuild
       - name: Generate SBOM with syft
         run: uv run compliance-assistant sbom generate -v -g syft -d . -o ${{ runner.temp }}/sbom-syft.json
         env:
@@ -46,7 +46,7 @@ jobs:
       - name: Install cdxgen # zizmor: ignore[adhoc-packages]
         run: npm install -g @cyclonedx/cdxgen
       - name: Install compliance-assistant
-        uses: ./.github/actions/uvbuild
+        uses: $/.github/actions/uvbuild
       - name: Generate SBOM with cdxgen
         run: uv run compliance-assistant sbom generate -v -g cdxgen -d . -o ${{ runner.temp }}/sbom-cdxgen.json
       - name: Store raw SBOM as artifact
@@ -63,7 +63,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/uvbuild
+      - uses: $/.github/actions/uvbuild
       - name: Download Syft SBOM artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -89,7 +89,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/uvbuild
+      - uses: $/.github/actions/uvbuild
       - name: Download cdxgen SBOM artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 054d754..a59a5a4 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/uvbuild
+      - uses: $/.github/actions/uvbuild
         with:
           python: ${{ matrix.python-version }}
           uv_args: --no-dev
@@ -72,7 +72,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/uvbuild
+      - uses: $/.github/actions/uvbuild
       - name: Lint with ruff
         run: uv run ruff check
 
@@ -82,7 +82,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/uvbuild
+      - uses: $/.github/actions/uvbuild
       - name: Check formatting with ruff
         run: uv run ruff format --check
 
@@ -92,7 +92,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ./.github/actions/uvbuild
+      - uses: $/.github/actions/uvbuild
       - name: Test typing with ty
         run: uv run ty check