rules:

dangerous-triggers:

ignore:

# pull_request_target is needed to label and assign PRs from forks with issues: write.

# The workflow does not check out or execute pull request code.

- oscca-pr.yml:3

# workflow_run is needed to post a PR comment from a fork's run, which is

# handed a read-only token however the triggering workflow is configured.

# The workflow does not check out or execute pull request code: it reads

# one artifact and writes a comment.

- pyperformance-comment.yaml:1

excessive-permissions:

ignore:

# pull_request_target is needed to post PR comments with pull-requests: write.

# Workflow-level permissions: {} restricts defaults; only the job has write access.

- lib-deps-check.yaml:3

unpinned-uses:

config:

policies:

# dtolnay/rust-toolchain is a trusted action that uses lightweight branch

# refs (@stable, @nightly, etc.) by design. Pinning to a hash would break

# the intended usage pattern.

# We can remove this once https://github.com/dtolnay/rust-toolchain/issues/180 is resolved

dtolnay/rust-toolchain: any

# dtolnay/rust-toolchain handles component installation, target addition, and

# override configuration beyond what a bare `rustup` invocation provides.

# See: https://github.com/zizmorcore/zizmor/issues/1817

superfluous-actions:

disable: true