build: use `oxlint --rules --format=json` for building rules #9

	name: GitHub Actions Security Analysis

	on:
	workflow_dispatch:
	pull_request:
	types: [opened, synchronize]
	paths:
	- '.github/workflows/**'
	push:
	branches:
	- main
	- 'renovate/**'
	paths:
	- '.github/workflows/**'

	jobs:
	zizmor:
	name: zizmor
	runs-on: ubuntu-latest
	permissions:
	security-events: write
	steps:
	- name: Checkout repository
	uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
	with:
	persist-credentials: false

	- uses: taiki-e/install-action@8c39981484df4e7ba41af8e8e078ac546d5e1b11 # v2.46.8
	with:
	tool: zizmor

	- name: Run zizmor
	run: zizmor --format sarif . > results.sarif
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

	- name: Upload SARIF file
	uses: github/codeql-action/upload-sarif@df409f7d9260372bd5f19e5b04e83cb3c43714ae # v3
	with:
	sarif_file: results.sarif
	category: zizmor

Provide feedback