rules:
  dangerous-triggers:
    ignore:
      # pull_request_target is needed to label and assign PRs from forks with issues: write.
      # The workflow does not check out or execute pull request code.
      - oscca-pr.yml:3
  excessive-permissions:
    ignore:
      # pull_request_target is needed to post PR comments with pull-requests: write.
      # Workflow-level permissions: {} restricts defaults; only the job has write access.
      - lib-deps-check.yaml:3
  unpinned-uses:
    config:
      policies:
        # dtolnay/rust-toolchain is a trusted action that uses lightweight branch
        # refs (@stable, @nightly, etc.) by design. Pinning to a hash would break
        # the intended usage pattern.
        # We can remove this once https://github.com/dtolnay/rust-toolchain/issues/180 is resolved
        dtolnay/rust-toolchain: any
  # dtolnay/rust-toolchain handles component installation, target addition, and
  # override configuration beyond what a bare `rustup` invocation provides.
  # See: https://github.com/zizmorcore/zizmor/issues/1817
  superfluous-actions:
    disable: true