From dd3f504c28f2bb5b70f66529ca5b30b31158666f Mon Sep 17 00:00:00 2001
From: Juan Mrad <juansmrad@gmail.com>
Date: Sun, 19 Jul 2026 20:04:43 -0500
Subject: [PATCH] Scope zizmor workflow to only run when workflow files change
 (#924)

Add paths filter so the GitHub Actions security scan only triggers
when .github/workflows/ files are modified, instead of on every PR.
---
 .github/workflows/zizmor.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 792fc9b..13ba49c 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -3,8 +3,10 @@ name: GitHub Actions security analysis
 on:
   push:
     branches: ['main']
+    paths: ['.github/workflows/**']
   pull_request:
     branches: ['**']
+    paths: ['.github/workflows/**']
 
 concurrency:
   group: zizmor-${{ github.ref }}
-- 
2.51.2