From e386081b46b798aeb605f8b1ea67ac82aaab1207 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Sat, 11 Jul 2026 19:22:30 -0700
Subject: [PATCH 1/5] Add shared zizmor workflow

---
 .github/workflows/zizmor.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 000000000..a17be2d1f
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,18 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '51 13 * * 5'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  zizmor:
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1
\ No newline at end of file

From 8f70ecc166bf11cc1823f562e3dd0263ede4af9e Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Sat, 11 Jul 2026 20:47:42 -0700
Subject: [PATCH 2/5] Add shared zizmor workflow

---
 .github/workflows/zizmor.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index a17be2d1f..889ca884a 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -9,10 +9,11 @@ on:
     - cron: '51 13 * * 5'
   workflow_dispatch:
 
-permissions:
-  contents: read
-  security-events: write
+permissions: {}
 
 jobs:
   zizmor:
+    permissions:
+      contents: read # for actions/checkout
+      security-events: write # for zizmor to upload SARIF results
     uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1
\ No newline at end of file

From d6a6268365463656309752a4842b3730c673cbf4 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Sat, 11 Jul 2026 21:42:40 -0700
Subject: [PATCH 3/5] Add trailing newline

---
 .github/workflows/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 889ca884a..14e8a1ef5 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -16,4 +16,4 @@ jobs:
     permissions:
       contents: read # for actions/checkout
       security-events: write # for zizmor to upload SARIF results
-    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1
\ No newline at end of file
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1

From a68648e6cd85eae686b73b32817a19828b4d6787 Mon Sep 17 00:00:00 2001
From: Trask Stalnaker <trask.stalnaker@gmail.com>
Date: Sun, 12 Jul 2026 19:13:30 -0600
Subject: [PATCH 4/5] Document zizmor schedule

---
 .github/workflows/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 14e8a1ef5..00ad6ffff 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -6,7 +6,7 @@ on:
   pull_request:
     branches: [main]
   schedule:
-    - cron: '51 13 * * 5'
+    - cron: '51 13 * * 5' # weekly at 13:51 UTC on Friday
   workflow_dispatch:
 
 permissions: {}

From e761119f7589bcfb49f00ab2ebe18ddf56d62b49 Mon Sep 17 00:00:00 2001
From: Trask Stalnaker <trask.stalnaker@gmail.com>
Date: Sun, 12 Jul 2026 19:26:26 -0600
Subject: [PATCH 5/5] Run zizmor on all pull requests

---
 .github/workflows/zizmor.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 00ad6ffff..777da30f1 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -4,7 +4,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
   schedule:
     - cron: '51 13 * * 5' # weekly at 13:51 UTC on Friday
   workflow_dispatch: