update relnotes process #4

	# This workflow runs on every repository with the custom property `crabwatch` set to `true`.

	name: Crabwatch

	on:
	pull_request:
	# merge_group required for repositories that use merge queues
	# https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#merge_group
	merge_group:
	types: [ checks_requested ]

	permissions: {}

	concurrency:
	group: ${{ github.workflow }}-${{ github.head_ref \|\| github.ref }}
	cancel-in-progress: true

	jobs:
	zizmor:
	name: Run zizmor
	runs-on: ubuntu-latest
	permissions:
	contents: read
	steps:
	- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
	with:
	persist-credentials: false

	- name: Download crabwatch zizmor config
	env:
	GH_TOKEN: ${{ github.token }}
	run: \|
	gh api repos/rust-lang/crabwatch/contents/zizmor-default.yml \
	-H "Accept: application/vnd.github.raw+json" > zizmor-default.yml

	- name: Run zizmor
	uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
	with:
	advanced-security: false
	config: zizmor-default.yml
	# Don't fail on repositories without GitHub Actions workflows.
	fail-on-no-inputs: false
	persona: pedantic

Navigation Menu