From f0a7a0ab0ce86d6c2b384cd61138796b56304277 Mon Sep 17 00:00:00 2001
From: Jan Calanog <jan.calanog@elastic.co>
Date: Wed, 5 Aug 2026 21:38:48 +0200
Subject: [PATCH] Move zizmor to pre-commit

Run zizmor through the zizmor-pre-commit hook instead of a dedicated
GitHub Actions workflow. This gives us local pre-commit coverage and
keeps PR checks in the existing pre-commit job, matching how
actionlint is already wired up.

Co-authored-by: Cursor <cursoragent@cursor.com>
---
 .github/workflows/zizmor.yml | 28 ----------------------------
 .pre-commit-config.yaml      |  5 +++++
 2 files changed, 5 insertions(+), 28 deletions(-)
 delete mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
deleted file mode 100644
index 6d356218..00000000
--- a/.github/workflows/zizmor.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-name: GitHub Actions Security Analysis with zizmor
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-
-permissions: {}
-
-jobs:
-  zizmor:
-    name: Run zizmor
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-        with:
-          persist-credentials: false
-
-      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
-        with:
-          advanced-security: false
-          annotations: true
-          config: .github/zizmor.yml
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 2558b8c9..115e21ee 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -24,6 +24,11 @@ repos:
       - id: actionlint
         exclude: '(\.lock\.yml$|^\.github/workflows/agentics-maintenance\.yml$)'
 
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.29.0
+    hooks:
+      - id: zizmor
+
   - repo: local
     hooks:
       - id: compile-workflows