# zizmor configuration — https://docs.zizmor.sh/configuration/
#
# cache-poisoning (release.yml):
#   The release pipeline restores build caches (Swatinem/rust-cache for the Rust
#   compilation, actions/setup-node) as a deliberate, accepted optimisation.
#   zizmor flags these under cache-poisoning because release.yml publishes
#   artifacts to crates.io / PyPI / npm, so a poisoned cache could in theory
#   reach a released build. Our caches are maintainer-controlled and the
#   restore speedup is kept on purpose; we accept this risk rather than running
#   cache-free release builds. (Six of the eight hits are actions/setup-node,
#   which zizmor reports at "Low" confidence.)
#
# artipacked (sync-about.yml):
#   The sync-about job checks out with persisted credentials on purpose: it
#   pushes the indicator-count fix-up back to the PR head branch (git commit +
#   git push), which needs the token in the runner's git config. It uploads no
#   artifacts, so the persisted token is never packaged or leaked; accept it.
#
# template-injection (sync-about.yml):
#   False positive. Every flagged expansion is steps.count.outputs.count, the
#   indicator count produced by an internal `grep -c` over lib.rs. It is not
#   attacker-controllable, so there is nothing to inject.
#
# use-trusted-publishing (release.yml):
#   Informational suggestion to use OIDC trusted publishing for PyPI / npm
#   instead of long-lived tokens. A worthwhile migration, but it reconfigures
#   the live publish pipeline on the registry side; tracked separately rather
#   than blocking on it here.
#
# superfluous-actions (release.yml):
#   The GitHub release step uses softprops/action-gh-release. The runner ships
#   `gh`, so this is replaceable by a script step, but the action is stable and
#   battle-tested; we keep it deliberately.
rules:
  cache-poisoning:
    ignore:
      - release.yml
  artipacked:
    ignore:
      - sync-about.yml
  template-injection:
    ignore:
      - sync-about.yml
  use-trusted-publishing:
    ignore:
      - release.yml
  superfluous-actions:
    ignore:
      - release.yml