From 559d0fc225a3356035e4d4fb772121d8327b0bf0 Mon Sep 17 00:00:00 2001
From: Benoit Marty <benoit@matrix.org>
Date: Mon, 9 Mar 2026 10:19:30 +0100
Subject: [PATCH] Setup zizmor and fix existing issue.

---
 .github/workflows/docs.yml             |  8 ++++++--
 .github/workflows/static_analyisis.yml | 20 ++++++++++++++++++++
 2 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/static_analyisis.yml

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index e0012e9c65..d5511da67e 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -4,13 +4,17 @@ on:
   push:
     branches: [ main ]
 
+permissions: {}
+
 jobs:
   docs:
     name: Generate and publish Android Matrix SDK documentation
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Build docs
         run: |
@@ -19,7 +23,7 @@ jobs:
           ./gradlew dokkaHtml
 
       - name: Deploy docs
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@4f9cc6602d3f66b9c108549d475ec49e8ef4d45e # v4.0.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./matrix-sdk-android/build/dokka/html
diff --git a/.github/workflows/static_analyisis.yml b/.github/workflows/static_analyisis.yml
new file mode 100644
index 0000000000..d67558ecb9
--- /dev/null
+++ b/.github/workflows/static_analyisis.yml
@@ -0,0 +1,20 @@
+name: Static analysis
+
+on:
+  pull_request: { }
+  push:
+    branches: [ main ]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0