# zizmor configuration
# https://docs.zizmor.sh/configuration/

rules:
  # Disable unpinned-uses - pinning to SHA hashes is a significant change
  # that should be done deliberately, not enforced by pre-commit
  unpinned-uses:
    disable: true

  # TODO(2026-10-01): Re-enable excessive-permissions after each workflow has an explicit permission review.
  excessive-permissions:
    disable: true

  # Disable artipacked (persist-credentials) - low confidence finding
  artipacked:
    disable: true