update-zizmor-notifcation-config (#529)

* update zizmor notifcation config

* TT-17286: replace slack notiifation with sariff  and PR comment

Author: olamilekan000

.github/workflows/pages.yml

@@ -25,7 +25,7 @@ jobs:
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # v4

policy/templates/zizmor/.github/workflows/zizmor.yml

@@ -4,18 +4,26 @@ name: zizmor
 
 on:
   pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
   push:
     branches:
       - {{ .Branch }}
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
 
 permissions: {}
 
 jobs:
   zizmor:
     uses: TykTechnologies/github-actions/.github/workflows/zizmor.yml@production
+    with:
+      upload_sarif: true
     permissions:
       security-events: write
       contents: read
       actions: read
-    secrets:
-      SLACK_WEBHOOK_URL: {{`${{ secrets.SLACK_WEBHOOK_URL }}`}}
+      pull-requests: write

policy/testdata/golden/ai-studio/main/.github/workflows/zizmor.yml

@@ -3,16 +3,24 @@
 name: zizmor
 on:
   pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
   push:
     branches:
       - main
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
 permissions: {}
 jobs:
   zizmor:
     uses: TykTechnologies/github-actions/.github/workflows/zizmor.yml@production
+    with:
+      upload_sarif: true
     permissions:
       security-events: write
       contents: read
       actions: read
-    secrets:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+      pull-requests: write

policy/testdata/golden/midsommar/main/.github/workflows/zizmor.yml

@@ -3,16 +3,24 @@
 name: zizmor
 on:
   pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
   push:
     branches:
       - main
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
 permissions: {}
 jobs:
   zizmor:
     uses: TykTechnologies/github-actions/.github/workflows/zizmor.yml@production
+    with:
+      upload_sarif: true
     permissions:
       security-events: write
       contents: read
       actions: read
-    secrets:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+      pull-requests: write

policy/testdata/golden/portal/master/.github/workflows/zizmor.yml

@@ -3,16 +3,24 @@
 name: zizmor
 on:
   pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
   push:
     branches:
       - master
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
 permissions: {}
 jobs:
   zizmor:
     uses: TykTechnologies/github-actions/.github/workflows/zizmor.yml@production
+    with:
+      upload_sarif: true
     permissions:
       security-events: write
       contents: read
       actions: read
-    secrets:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+      pull-requests: write

policy/testdata/golden/tyk-analytics/master/.github/workflows/zizmor.yml

@@ -3,16 +3,24 @@
 name: zizmor
 on:
   pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
   push:
     branches:
       - master
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
 permissions: {}
 jobs:
   zizmor:
     uses: TykTechnologies/github-actions/.github/workflows/zizmor.yml@production
+    with:
+      upload_sarif: true
     permissions:
       security-events: write
       contents: read
       actions: read
-    secrets:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+      pull-requests: write

policy/testdata/golden/tyk-analytics/release-5.13.1/.github/workflows/zizmor.yml

@@ -3,16 +3,24 @@
 name: zizmor
 on:
   pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
   push:
     branches:
       - release-5.13.1
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
 permissions: {}
 jobs:
   zizmor:
     uses: TykTechnologies/github-actions/.github/workflows/zizmor.yml@production
+    with:
+      upload_sarif: true
     permissions:
       security-events: write
       contents: read
       actions: read
-    secrets:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+      pull-requests: write

policy/testdata/golden/tyk-analytics/release-5.13/.github/workflows/zizmor.yml

@@ -3,16 +3,24 @@
 name: zizmor
 on:
   pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
   push:
     branches:
       - release-5.13
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
 permissions: {}
 jobs:
   zizmor:
     uses: TykTechnologies/github-actions/.github/workflows/zizmor.yml@production
+    with:
+      upload_sarif: true
     permissions:
       security-events: write
       contents: read
       actions: read
-    secrets:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+      pull-requests: write

policy/testdata/golden/tyk-analytics/release-5.14.0/.github/workflows/zizmor.yml

@@ -3,16 +3,24 @@
 name: zizmor
 on:
   pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
   push:
     branches:
       - release-5.14.0
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
 permissions: {}
 jobs:
   zizmor:
     uses: TykTechnologies/github-actions/.github/workflows/zizmor.yml@production
+    with:
+      upload_sarif: true
     permissions:
       security-events: write
       contents: read
       actions: read
-    secrets:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+      pull-requests: write

policy/testdata/golden/tyk-analytics/release-5.14/.github/workflows/zizmor.yml

@@ -3,16 +3,24 @@
 name: zizmor
 on:
   pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
   push:
     branches:
       - release-5.14
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
 permissions: {}
 jobs:
   zizmor:
     uses: TykTechnologies/github-actions/.github/workflows/zizmor.yml@production
+    with:
+      upload_sarif: true
     permissions:
       security-events: write
       contents: read
       actions: read
-    secrets:
-      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+      pull-requests: write