Attach zizmor on dependabot.{yml,yaml} and action.yml as well

Author: peytondmurray

lsp/zizmor.lua

@@ -17,31 +17,18 @@ return {
 
   -- `root_dir` ensures that the LSP does not attach to all yaml files
   root_dir = function(bufnr, on_dir)
-    local parent = vim.fs.dirname(vim.api.nvim_buf_get_name(bufnr))
+    local bufname = vim.api.nvim_buf_get_name(bufnr)
+    local parent = vim.fs.dirname(bufname)
     if
       vim.endswith(parent, '/.github/workflows')
       or vim.endswith(parent, '/.forgejo/workflows')
       or vim.endswith(parent, '/.gitea/workflows')
+      or (vim.endswith(bufname, "/.github/dependabot.yml") or vim.endswith(bufname, "/.github/dependabot.yaml"))
+      or vim.endswith(bufname, 'actions.yml') -- Composite actions can live in any repository subdirectory
     then
       on_dir(parent)
     end
   end,
-  handlers = {
-    ['actions/readFile'] = function(_, result)
-      if type(result.path) ~= 'string' then
-        return nil, nil
-      end
-      local file_path = vim.uri_to_fname(result.path)
-      if vim.fn.filereadable(file_path) == 1 then
-        local f = assert(io.open(file_path, 'r'))
-        local text = f:read('*a')
-        f:close()
-
-        return text, nil
-      end
-      return nil, nil
-    end,
-  },
   init_options = {}, -- needs to be present https://github.com/neovim/nvim-lspconfig/pull/3713#issuecomment-2857394868
   capabilities = {
     workspace = {