From f845da65733acc5f686762cdd2e1315dec2d6fc1 Mon Sep 17 00:00:00 2001
From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com>
Date: Sat, 31 Oct 2026 19:57:40 +0000
Subject: [PATCH 1/2] chore: add the org zizmor config and a Dependabot
 cooldown

zizmor flagged the shared cpp-linter/.github workflows called at @main
and Dependabot updates without a cooldown. Use the same zizmor.yml as
cpp-linter and cpp-linter-rs (cpp-linter/* may use any ref) and a
7-day cooldown.
---
 .github/dependabot.yml | 4 ++++
 .github/zizmor.yml     | 8 ++++++++
 2 files changed, 12 insertions(+)
 create mode 100644 .github/zizmor.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 94fa971..00451cd 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,6 +9,8 @@ updates:
     directory: /
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       actions:
         patterns:
@@ -17,6 +19,8 @@ updates:
     directory: /
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: build
     groups:
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..bf8fd1a
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,8 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: ref-pin
+        github/*: ref-pin
+        dependabot/*: ref-pin
+        cpp-linter/*: any

From 0b144f8f315bcc4d49f26948a69ac7060b53552f Mon Sep 17 00:00:00 2001
From: Xianpeng Shen <3353385+shenxianpeng@users.noreply.github.com>
Date: Sat, 31 Oct 2026 20:06:12 +0000
Subject: [PATCH 2/2] chore: drop per-repo zizmor config

---
 .github/zizmor.yml | 8 --------
 1 file changed, 8 deletions(-)
 delete mode 100644 .github/zizmor.yml

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
deleted file mode 100644
index bf8fd1a..0000000
--- a/.github/zizmor.yml
+++ /dev/null
@@ -1,8 +0,0 @@
-rules:
-  unpinned-uses:
-    config:
-      policies:
-        actions/*: ref-pin
-        github/*: ref-pin
-        dependabot/*: ref-pin
-        cpp-linter/*: any