DEVOPS-977: default zizmor config to allow MiraGeoscience unpinned act…

[andrewg-mira]

DEVOPS-977 - Zizmor: Allow trusted tag-pinned github actions
…ions

[sebhmg]

see suggestion for merging config with existing zizmor file

[sebhmg]

suggestion: patch existing zizmor config, even if it has more than one line

uses yq (yq is installed on Ubuntu according to https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md)

      run: |
        # Create zizmor config if missing
        if [[ ! -f zizmor.yml || $(wc -l < zizmor.yml) -eq 1 ]]; thenif [[ ! -f zizmor.yml ]]; then
          echo "Creating a custom zizmor.yml configuration file for CI..."
          cat > zizmor.yml << 'EOF'
        rules:
          dependabot-cooldown:
            disable: trueEOF
        fi

        # Patch (merge) with extra config
        yq -i '
          .rules |= (. // {}) |
          .rules."unpinned-uses" |= (. // {}) |
          .rules."unpinned-uses".config |= (. // {}) |
          .rules."unpinned-uses".config.policies |= (. // {}) |
          .rules."unpinned-uses".config.policies."MiraGeoscience/*" = "any"
        ' zizmor.yml