From 643d853b38c97d2c84d17a215cde61757f5f935a Mon Sep 17 00:00:00 2001
From: qiyinxi <qiyinxi@foxmail.com>
Date: Sat, 7 Nov 2026 10:06:25 +0100
Subject: [PATCH 1/2] =?UTF-8?q?ci:=20PR=20=E6=A3=80=E6=9F=A5=E5=8A=A0=20me?=
 =?UTF-8?q?rge=5Fgroup=20=E7=AD=89=E8=A7=A6=E5=8F=91=EF=BC=8Czizmor=20?=
 =?UTF-8?q?=E6=89=AB=20workflow=EF=BC=8CDependabot=20=E6=AF=8F=E6=9C=88?=
 =?UTF-8?q?=E6=9B=B4=E6=96=B0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refs ModAVD/ModAVD#127
---
 .github/dependabot.yml      | 13 +++++++++++++
 .github/workflows/ci.yml    | 26 ++++++++++++++++++++++++++
 scripts/test_repo_checks.py |  2 ++
 3 files changed, 41 insertions(+)
 create mode 100644 .github/dependabot.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ae2b8bc
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+# 每月一次，每个生态合成一个 PR（Refs ModAVD/ModAVD#127）。
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8f90cb3..e17373a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -2,6 +2,9 @@ name: CI
 
 on:
   pull_request:
+  push:
+    branches: [main]
+  merge_group:
   workflow_dispatch:
 
 permissions:
@@ -149,3 +152,26 @@ jobs:
       - name: Check commit authors and trailers
         shell: bash
         run: python3 -B -I -X utf8 scripts/repo_checks.py
+
+  zizmor:
+    name: Workflow security (zizmor)
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
+    steps:
+      - name: Checkout without persistent credentials
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install zizmor 1.32.0 (version and wheel hash pinned)
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 -m venv "$RUNNER_TEMP/zizmor"
+          printf '%s\n' 'zizmor==1.32.0 --hash=sha256:84a6acb975accc13408786a2bd274b572537ca19c933ebbc13e78f3988562071' > "$RUNNER_TEMP/zizmor-requirements.txt"
+          "$RUNNER_TEMP/zizmor/bin/pip" install --quiet --disable-pip-version-check --no-deps --only-binary=:all: \
+            --require-hashes -r "$RUNNER_TEMP/zizmor-requirements.txt"
+      - name: Audit workflows and Dependabot config
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: '"$RUNNER_TEMP/zizmor/bin/zizmor" --format=github --no-progress .'
diff --git a/scripts/test_repo_checks.py b/scripts/test_repo_checks.py
index e854e16..965508a 100644
--- a/scripts/test_repo_checks.py
+++ b/scripts/test_repo_checks.py
@@ -11,6 +11,8 @@ class RepoChecksTest(unittest.TestCase):
     def test_allowed_identities(self):
         self.assertTrue(repo_checks.identity_allowed("qiyinxi", "qiyinxi@foxmail.com"))
         self.assertTrue(repo_checks.identity_allowed("Bot", "123+bot[bot]@users.noreply.github.com"))
+        # Dependabot 的提交作者，原样照 GitHub 写的抄。
+        self.assertTrue(repo_checks.identity_allowed("dependabot[bot]", "49699333+dependabot[bot]@users.noreply.github.com"))
         self.assertTrue(repo_checks.identity_allowed("Old", "octocat@users.noreply.github.com"))
 
     def test_rejects_private_or_ai_identities(self):

From 7f9f35813603e2e26a6c4f14e362c3a32ed394d4 Mon Sep 17 00:00:00 2001
From: qiyinxi <qiyinxi@foxmail.com>
Date: Sat, 7 Nov 2026 10:16:12 +0100
Subject: [PATCH 2/2] =?UTF-8?q?ci:=20=E4=BD=9C=E8=80=85=E6=A3=80=E6=9F=A5?=
 =?UTF-8?q?=E5=8F=AA=E5=9C=A8=20pull=5Frequest=20=E5=92=8C=E6=89=8B?=
 =?UTF-8?q?=E5=8A=A8=E8=A7=A6=E5=8F=91=E6=97=B6=E8=B7=91?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

push 和 merge_group 下要查的只剩 GitHub 生成的 squash 提交，作者邮箱由贡献者账号设置决定，查了会让合并队列和 main 无端变红。

Refs ModAVD/ModAVD#127
---
 .github/workflows/ci.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e17373a..5777031 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -149,7 +149,10 @@ jobs:
       - name: Run repo checks unit tests
         shell: bash
         run: python3 -B -I -X utf8 scripts/test_repo_checks.py -v
+      # PR 里的提交在 pull_request 时已经查过。push 和 merge_group 下要查的只剩 GitHub 生成的 squash 提交，
+      # 它的作者邮箱取自贡献者 GitHub 账号的设置，不归作者检查管；查了会让合并队列和 main 无端变红。
       - name: Check commit authors and trailers
+        if: github.event_name == 'pull_request' || github.event_name == 'workflow_dispatch'
         shell: bash
         run: python3 -B -I -X utf8 scripts/repo_checks.py