# Centralized zizmor ignore-list (allow-list) for the Geolonia org.

#

# The Security Suite fetches this file when a repo has no zizmor.yml of its

# own, so org-wide accepted findings are suppressed in ONE place (the same

# pattern as the canonical .pinact.yml). A repo can override by committing

# its own zizmor.yml.

#

# IMPORTANT: zizmor's `ignore` entries are matched by exact workflow

# filename (optionally `name.yml:line` or `name.yml:line:col`); globs like

# `*.yml` are NOT supported. So an entry suppresses a rule only in files

# with that basename. That is ideal for the org-standard workflows that are

# copied into many repos (publish-techdocs.yml, security-suite.yml, ...), but

# it cannot disable a rule everywhere. Prefer fixing over ignoring; keep

# every entry below justified.

#

# Example (uncomment + justify when the org accepts a finding):

#

# rules:

# template-injection:

# ignore:

# - publish-techdocs.yml # one-line justification for the exception

rules:

# unpinned-uses policies are matched by repo pattern (owner/repo, owner/*,

# *), NOT by filename, so this applies org-wide (unlike the `ignore` list

# above). Our own reusable workflows float on a bot-moved major tag (@v1)

# by design: a vX.Y.Z release fast-forwards vX, so a symbolic ref is the

# intended state for them. Allow ref-pin for the geolonia org and keep the

# strict hash-pin blanket policy for every other (third-party) action.

# Mirrors the matching .pinact.yml exemption; see that file for the full

# rationale.

#

# Scope note: this uses the owner glob `geolonia/*`, not an exact repo. A

# reusable-workflow `uses:` carries the full path (geolonia/.github/.github/

# workflows/x.yml), which zizmor's exact `owner/repo` pattern does not

# match; only the owner glob does. This lines up with pinact's own `geolonia/*`

# scope. ref-pin also permits a branch ref like @main, but pinact still

# flags anything other than a bare major tag, so the combined gate keeps

# mutable refs out.

unpinned-uses:

config:

policies:

"geolonia/*": ref-pin

"*": hash-pin

# Accepted: the TechDocs publish job installs its build toolchain

# (@techdocs/cli via npm, mkdocs plugins via pip) at run time. These

# publishing tools are not part of any repo lockfile, so an ad-hoc install

# is expected. Scoped to the filename (zizmor `ignore` is exact-basename).

adhoc-packages:

ignore:

- reusable-backstage-techdocs.yml