From b0c1c4b40edbf9cd845ce12cbf4a2a9fb4d24370 Mon Sep 17 00:00:00 2001
From: Carl Tashian <carl@smallstep.com>
Date: Tue, 3 Mar 2026 08:58:44 -0800
Subject: [PATCH] ci: Enable zizmor GitHub Advanced Security upload

Public repos need to explicitly enable GHAS upload now that the
actionci.yml default has been changed to false.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/actionci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/actionci.yml b/.github/workflows/actionci.yml
index 81a6873e6..03cc12094 100644
--- a/.github/workflows/actionci.yml
+++ b/.github/workflows/actionci.yml
@@ -19,4 +19,6 @@ jobs:
       contents: read
       security-events: write
     uses: smallstep/workflows/.github/workflows/actionci.yml@main
+    with:
+      zizmor-advanced-security: true
     secrets: inherit