From c4f2af70f09b8963e940b956c0aebe0f78d073ee Mon Sep 17 00:00:00 2001
From: Diego Rodrigues de Sa e Souza
 <8016841+diegosouzapw@users.noreply.github.com>
Date: Sun, 14 Jun 2026 18:03:21 -0300
Subject: [PATCH] ci(quality): install advisory security scanners so Fase 7
 gates run (gitleaks/osv/actionlint/zizmor) (#3858)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Integrated into release/v3.8.25 — Fase 7: scanners advisory no CI (gitleaks/osv/actionlint/zizmor).
---
 .github/workflows/ci.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8ff70a2d93..285ab51bef 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -135,6 +135,20 @@ jobs:
         run: npm run check:codeql-ratchet
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Fase 7 INT: install the advisory security scanners so the gates below
+      # actually run (they self-skip when the binaries are absent). go install
+      # uses documented module paths (no fragile version-pinned URLs); zizmor is
+      # a PyPI package. Whole job is continue-on-error, so an install hiccup never
+      # blocks the build. Exercised at the next release→main run.
+      - name: Install advisory security scanners (gitleaks/osv/actionlint/zizmor)
+        continue-on-error: true
+        run: |
+          go install github.com/rhysd/actionlint/cmd/actionlint@latest
+          go install github.com/gitleaks/gitleaks/v8@latest
+          go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
+          echo "$HOME/go/bin" >> "$GITHUB_PATH"
+          pipx install zizmor || pip install --user zizmor
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - name: Secret scan (gitleaks; skips if absent)
         run: npm run check:secrets
       - name: Vulnerability ratchet (osv-scanner; skips if absent)