# zizmor configuration — https://docs.zizmor.sh/configuration/
#
# cache-poisoning (release.yml):
#   The release pipeline restores build caches (Swatinem/rust-cache for the Rust
#   compilation, actions/setup-node) as a deliberate, accepted optimisation.
#   zizmor flags these under cache-poisoning because release.yml publishes
#   artifacts to crates.io / PyPI / npm, so a poisoned cache could in theory
#   reach a released build. Our caches are maintainer-controlled and the
#   restore speedup is kept on purpose; we accept this risk rather than running
#   cache-free release builds. (Six of the eight hits are actions/setup-node,
#   which zizmor reports at "Low" confidence.)
#
# artipacked (sync-about.yml):
#   The sync-about job checks out with persisted credentials on purpose: it
#   pushes the indicator-count fix-up back to the PR head branch (git commit +
#   git push), which needs the token in the runner's git config. It uploads no
#   artifacts, so the persisted token is never packaged or leaked; accept it.
rules:
  cache-poisoning:
    ignore:
      - release.yml
  artipacked:
    ignore:
      - sync-about.yml