name: Zizmor GitHub Actions Security

on:
  workflow_dispatch:
  workflow_call:  # Called by release-gate.yml
  schedule:
    # Run security audit weekly on Monday at 9 AM UTC
    - cron: '0 9 * * 1'

permissions:
  contents: read

jobs:
  zizmor-scan:
    name: Zizmor Workflow Security Scan
    runs-on: ubuntu-latest
    timeout-minutes: 30
    permissions:
      contents: read
      security-events: write
      actions: read

    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

        with:
          persist-credentials: false

      - name: Run zizmor security scan
        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
        with:
          inputs: .github/workflows/
          min-severity: low
          advanced-security: true
          token: ${{ secrets.GITHUB_TOKEN }}

      - name: Display scan summary
        if: always()
        run: |
          {
            echo "## Zizmor GitHub Actions Security Scan"
            echo ""
            echo "### What is Zizmor?"
            echo "Zizmor is a security linter for GitHub Actions workflows that detects:"
            echo ""
            echo "- **Template Injection**: Attacker-controlled input in expressions"
            echo "- **ArtiPACKED**: Credentials leaked in workflow artifacts"
            echo "- **Vulnerable Actions**: Third-party actions with known CVEs"
            echo "- **Impostor Commits**: Hash-pinned actions pointing to forks"
            echo "- **Hardcoded Credentials**: Plain-text secrets in workflows"
            echo "- **Excessive Permissions**: Over-privileged workflow tokens"
            echo "- **Unpinned Actions**: Mutable action references"
            echo "- **Cache Poisoning**: Unsafe cache usage patterns"
            echo ""
            echo "### Resources"
            echo "- [Zizmor GitHub](https://github.com/woodruffw/zizmor)"
            echo "- [Security Tab](https://github.com/${{ github.repository }}/security/code-scanning)"
            echo "- Results uploaded to GitHub Security tab for detailed analysis"
          } >> "$GITHUB_STEP_SUMMARY"