amplify.yml

---
# This should mostly be the production version of the workflow (i.e. Amplify is
# "installed" in this repo just like any other). It is otherwise not integrated
# with the contents of the repo itself (the CI workflow instead tests changes)
name: Amplify Security
on:
  pull_request: {}
  workflow_dispatch: {}
  push:
    branches: ["main", "develop"]

permissions:
  contents: read
  id-token: write

jobs:
  amplify-security-scan:
    name: Amplify Security Scan
    runs-on: ubuntu-latest
    if: (!github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]')
    steps:
      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          persist-credentials: false
      - name: Amplify Runner
        uses: amplify-security/runner-action@main # zizmor: ignore[unpinned-uses]