From 7680984b7dfd566d1e2dae958f22c221bcce47b7 Mon Sep 17 00:00:00 2001
From: qiyinxi <qiyinxi@foxmail.com>
Date: Sat, 7 Nov 2026 10:06:32 +0100
Subject: [PATCH] =?UTF-8?q?ci:=20PR=20=E6=A3=80=E6=9F=A5=E5=8A=A0=20merge?=
 =?UTF-8?q?=5Fgroup=20=E7=AD=89=E8=A7=A6=E5=8F=91=EF=BC=8Czizmor=20?=
 =?UTF-8?q?=E6=89=AB=20workflow=EF=BC=8CDependabot=20=E6=AF=8F=E6=9C=88?=
 =?UTF-8?q?=E6=9B=B4=E6=96=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refs ModAVD/ModAVD#127
---
 .github/dependabot.yml      | 13 +++++++++++++
 .github/workflows/check.yml | 28 +++++++++++++++++++++++++++-
 2 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ae2b8bc
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+# 每月一次，每个生态合成一个 PR（Refs ModAVD/ModAVD#127）。
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 6c1a611..69ce796 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -2,8 +2,11 @@ name: Static checks
 
 # 只做静态检查：实跑要模拟器、显卡和游戏，在维护者和平台负责人自己的测试机上跑（见 README）。
 on:
-  push:
   pull_request:
+  push:
+    branches: [main]
+  merge_group:
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -55,3 +58,26 @@ jobs:
         run: ./tests/fetch-item.ps1
       - name: Scan tracked files for private identity and paths
         run: python3 .modavd/scripts/privacy.py .
+
+  zizmor:
+    name: Workflow security (zizmor)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout without persistent credentials
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - name: Install zizmor 1.32.0 (version and wheel hash pinned)
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 -m venv "$RUNNER_TEMP/zizmor"
+          printf '%s\n' 'zizmor==1.32.0 --hash=sha256:84a6acb975accc13408786a2bd274b572537ca19c933ebbc13e78f3988562071' > "$RUNNER_TEMP/zizmor-requirements.txt"
+          "$RUNNER_TEMP/zizmor/bin/pip" install --quiet --disable-pip-version-check --no-deps --only-binary=:all: \
+            --require-hashes -r "$RUNNER_TEMP/zizmor-requirements.txt"
+      - name: Audit workflows and Dependabot config
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: '"$RUNNER_TEMP/zizmor/bin/zizmor" --format=github --no-progress .'