From f38ada2f108d1de748aaea4a64bca56817114a60 Mon Sep 17 00:00:00 2001
From: James Alseth <jalseth@google.com>
Date: Mon, 22 Jun 2026 20:04:53 +0000
Subject: [PATCH] feat: Allow enforcement via GCS config

---
 .github/workflows/github_actions_scan.yml      | 12 +++++++++++-
 .github/workflows/test_github_actions_scan.yml |  2 +-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/github_actions_scan.yml b/.github/workflows/github_actions_scan.yml
index d5f3028..42cd84d 100644
--- a/.github/workflows/github_actions_scan.yml
+++ b/.github/workflows/github_actions_scan.yml
@@ -115,7 +115,17 @@ jobs:
         id: 'identify-enforcement'
         shell: 'bash'
         run: |
-          echo "enforce=${ZIZMOR_ENFORCE}" >> "$GITHUB_OUTPUT"
+          FINAL_ENFORCE="${ZIZMOR_ENFORCE}"
+          CONFIG_ENFORCE="$(yq eval '.google.enforce' zizmor-config.yaml)"
+          if [[ "${CONFIG_ENFORCE}" = "true" || "${CONFIG_ENFORCE}" = "false" ]]; then
+            echo "Using enforcment value from config: ${CONFIG_ENFORCE}"
+            FINAL_ENFORCE="${CONFIG_ENFORCE}"
+          fi
+          echo "enforce=${FINAL_ENFORCE}" >> "$GITHUB_OUTPUT"
+      - name: 'Remove non-standard google key'
+        shell: 'bash'
+        run: |
+          yq 'del(.google)' -i zizmor-config.yaml
       - name: 'Rewrite mandatory to high in config'
         shell: 'bash'
         run: |
diff --git a/.github/workflows/test_github_actions_scan.yml b/.github/workflows/test_github_actions_scan.yml
index 7813002..808fccd 100644
--- a/.github/workflows/test_github_actions_scan.yml
+++ b/.github/workflows/test_github_actions_scan.yml
@@ -16,4 +16,4 @@ jobs:
       wif_provider: 'projects/763312321262/locations/global/workloadIdentityPools/gitsec-gha-artifacts/providers/gitsec-gha-artifacts-provider'
       zizmor_result_bucket: 'zizmor-43e4'
       zizmor_config_bucket: 'zizmor-configs-06f3'
-      zizmor_enforce: 'true'
+      zizmor_enforce: 'false'