.github/zizmor.yml

rules:
  unpinned-uses:
    config:
      policies:
        "*": ref-pin # Allow non-hashed pins, but still require versioned