Setup backport workflow and sync next setup (#2057)

bluwy · web-flow · commit c70c675c2a22 · 2026-06-07T17:17:57.000Z
* Setup backport workflow and sync next setup

* sync

* update branch
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -2,10 +2,13 @@ name: CI
 
 on:
   pull_request:
-  push:
-    branches: [main]
+  # merge queue is required so all commits on target branches trigger this workflow
+  # despite lack of the push event trigger here
   merge_group:
-    branches: [main]
+    branches:
+      - main
+      - next
+      - "maintenance/v[0-9]+"
 
 permissions:
   contents: read
@@ -15,6 +18,25 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  lint-workflows:
+    name: Lint workflows
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read # only required in private repos
+      security-events: write # allow writing security events
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          persona: pedantic
+          annotations: true
+          advanced-security: false
+
   test:
     name: Test
     runs-on: ubuntu-latest
@@ -75,8 +97,8 @@ jobs:
     name: CI OK
     runs-on: ubuntu-latest
     if: always()
-    needs: [test, typecheck, lint]
+    needs: [lint-workflows, test, typecheck, lint]
     steps:
       - name: Exit with error if some jobs are not successful
         run: exit 1
-        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'skipped') || contains(needs.*.result, 'cancelled')) }}
+        if: ${{ always() && (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled')) }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - next
+      - "maintenance/v[0-9]+"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
