docs: Clarify Live API START/END_SENSITIVITY_HIGH/LOW defaults are different in Gemini Live and Gemini Enterprise Agent Platform Live API #426
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: 'GitHub Actions Scan' | |
| on: | |
| workflow_call: | |
| inputs: | |
| wif_provider: | |
| type: 'string' | |
| zizmor_result_bucket: | |
| type: 'string' | |
| pull_request_target: | |
| permissions: {} | |
| env: | |
| ZIZMOR_VERSION: '1.25.2' | |
| ZIZMOR_DOCKER_DIGEST: 'sha256:14ea7f5cc7c67933394a35b5a38a277397818d232602635edb2010b313afb110' | |
| ZIZMOR_ENFORCE: 'false' | |
| ZIZMOR_RESULT_BUCKET: 'zizmor-7165' | |
| WIF_PROVIDER: 'projects/102295818544/locations/global/workloadIdentityPools/gitsec-gha-artifacts/providers/gitsec-gha-artifacts-provider' | |
| jobs: | |
| check-changes: | |
| runs-on: 'ubuntu-latest' | |
| outputs: | |
| files: '${{ steps.check.outputs.files }}' | |
| permissions: | |
| contents: 'read' | |
| steps: | |
| - name: 'Checkout source' | |
| uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v6 | |
| with: | |
| ref: '${{ github.event.pull_request.head.sha }}' | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: 'Check for workflow changes' | |
| id: 'check' | |
| shell: 'bash' | |
| env: | |
| GIT_HEAD_SHA: '${{ github.event.pull_request.head.sha }}' | |
| GIT_BASE_SHA: '${{ github.event.pull_request.base.sha }}' | |
| run: | | |
| files=$(git diff --name-only --diff-filter=d "${GIT_BASE_SHA}" "${GIT_HEAD_SHA}" | grep -E '^\.github/workflows/.+\.ya?ml$' | xargs || true) | |
| echo "files=$files" >> "$GITHUB_OUTPUT" | |
| zizmor-scan: | |
| needs: ['check-changes'] | |
| runs-on: 'ubuntu-latest' | |
| if: >- | |
| needs.check-changes.outputs.files != '' && | |
| ( | |
| inputs.wif_provider != '' || | |
| ( | |
| github.event_name == 'pull_request_target' && | |
| !startsWith(github.workflow_ref, format('{0}/', github.repository)) | |
| ) | |
| ) | |
| permissions: | |
| contents: 'read' | |
| outputs: | |
| has-high-severity: '${{ steps.check-findings-severity.outputs.has-high-severity }}' | |
| zizmor-enforce: '${{ steps.check-findings-severity.outputs.zizmor-enforce }}' | |
| steps: | |
| - name: 'Checkout source' | |
| uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v6 | |
| with: | |
| ref: '${{ github.event.pull_request.head.sha }}' | |
| persist-credentials: false | |
| - name: 'Run zizmor' | |
| shell: 'bash' | |
| env: | |
| GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}' | |
| CHANGED_FILES: '${{ needs.check-changes.outputs.files }}' | |
| run: >- | |
| docker run | |
| --rm | |
| --volume "${GITHUB_WORKSPACE}:/workspace:ro" | |
| --workdir "/workspace" | |
| --env GH_TOKEN="${GH_TOKEN}" | |
| "ghcr.io/zizmorcore/zizmor:${ZIZMOR_VERSION}@${ZIZMOR_DOCKER_DIGEST}" | |
| --format sarif | |
| --no-ignores | |
| -- | |
| ${CHANGED_FILES} | |
| > zizmor.sarif.json | |
| - name: 'Enrich SARIF with GitHub metadata' | |
| shell: 'bash' | |
| run: >- | |
| jq | |
| --arg uri "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" | |
| --arg sha "${GITHUB_SHA}" | |
| --argjson repo_id "${GITHUB_REPOSITORY_ID}" | |
| --argjson owner_id "${GITHUB_REPOSITORY_OWNER_ID}" | |
| --arg run_id "${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}" | |
| '.runs[] |= . + { | |
| "versionControlProvenance": [ | |
| { | |
| "repositoryUri": $uri, | |
| "revisionId": $sha, | |
| "properties": { | |
| "github_repository_id": $repo_id, | |
| "github_owner_id": $owner_id | |
| } | |
| } | |
| ], | |
| "invocations": [ | |
| { | |
| "executionSuccessful": true, | |
| "properties": { | |
| "execution_id": $run_id | |
| } | |
| } | |
| ] | |
| }' zizmor.sarif.json > enriched.sarif.json | |
| - name: 'Save result' | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # ratchet:actions/upload-artifact@v7 | |
| with: | |
| name: 'zizmor' | |
| path: 'enriched.sarif.json' | |
| if-no-files-found: 'error' | |
| retention-days: 1 | |
| - name: 'Check for high severity findings' | |
| id: 'check-findings-severity' | |
| shell: 'bash' | |
| run: | | |
| result=$(jq 'any(.runs[].results[]?; .properties["zizmor/severity"] == "High")' zizmor.sarif.json) | |
| echo "has-high-severity=$result" >> "$GITHUB_OUTPUT" | |
| echo "zizmor-enforce=${ZIZMOR_ENFORCE}" >> "$GITHUB_OUTPUT" | |
| zizmor-upload: | |
| needs: ['zizmor-scan'] | |
| runs-on: 'ubuntu-latest' | |
| permissions: | |
| contents: 'read' | |
| id-token: 'write' | |
| steps: | |
| - name: 'Retrieve result' | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # ratchet:actions/download-artifact@v8 | |
| with: | |
| name: 'zizmor' | |
| - name: 'Authenticate to GCP' | |
| uses: 'google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed' # ratchet:google-github-actions/auth@v2 | |
| with: | |
| workload_identity_provider: >- | |
| ${{ inputs.wif_provider != '' && inputs.wif_provider || env.WIF_PROVIDER }} | |
| - name: 'Upload result' | |
| shell: 'bash' | |
| env: | |
| GITHUB_PULL_REQUEST_NUMBER: '${{ github.event.pull_request.number }}' | |
| ZIZMOR_RESULT_BUCKET: >- | |
| ${{ inputs.zizmor_result_bucket != '' && inputs.zizmor_result_bucket || env.ZIZMOR_RESULT_BUCKET }} | |
| run: >- | |
| gcloud storage cp | |
| enriched.sarif.json | |
| "gs://${ZIZMOR_RESULT_BUCKET}/${GITHUB_REPOSITORY}/${GITHUB_PULL_REQUEST_NUMBER}_${GITHUB_RUN_ID}_${GITHUB_RUN_ATTEMPT}.sarif.json" | |
| zizmor-output: | |
| needs: ['zizmor-scan'] | |
| runs-on: 'ubuntu-latest' | |
| permissions: | |
| contents: 'read' | |
| if: >- | |
| needs.zizmor-scan.outputs.zizmor-enforce == 'true' && | |
| needs.zizmor-scan.outputs.has-high-severity == 'true' | |
| steps: | |
| - name: 'Checkout source' | |
| uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v6 | |
| with: | |
| ref: '${{ github.event.pull_request.head.sha }}' | |
| persist-credentials: false | |
| - name: 'Re-run zizmor with github format' | |
| shell: 'bash' | |
| env: | |
| GH_TOKEN: '${{ secrets.GITHUB_TOKEN }}' | |
| CHANGED_FILES: '${{ needs.check-changes.outputs.files }}' | |
| run: >- | |
| docker run | |
| --rm | |
| --volume "${GITHUB_WORKSPACE}:/workspace:ro" | |
| --workdir "/workspace" | |
| --env GH_TOKEN="${GH_TOKEN}" | |
| "ghcr.io/zizmorcore/zizmor:${ZIZMOR_VERSION}@${ZIZMOR_DOCKER_DIGEST}" | |
| --format github | |
| -- | |
| ${CHANGED_FILES} |