feat: Allow enforcement via GCS config (#26)

Author: jalseth

.github/workflows/github_actions_scan.yml

@@ -115,7 +115,17 @@ jobs:
         id: 'identify-enforcement'
         shell: 'bash'
         run: |
-          echo "enforce=${ZIZMOR_ENFORCE}" >> "$GITHUB_OUTPUT"
+          FINAL_ENFORCE="${ZIZMOR_ENFORCE}"
+          CONFIG_ENFORCE="$(yq eval '.google.enforce' zizmor-config.yaml)"
+          if [[ "${CONFIG_ENFORCE}" = "true" || "${CONFIG_ENFORCE}" = "false" ]]; then
+            echo "Using enforcment value from config: ${CONFIG_ENFORCE}"
+            FINAL_ENFORCE="${CONFIG_ENFORCE}"
+          fi
+          echo "enforce=${FINAL_ENFORCE}" >> "$GITHUB_OUTPUT"
+      - name: 'Remove non-standard google key'
+        shell: 'bash'
+        run: |
+          yq 'del(.google)' -i zizmor-config.yaml
       - name: 'Rewrite mandatory to high in config'
         shell: 'bash'
         run: |

.github/workflows/test_github_actions_scan.yml

@@ -16,4 +16,4 @@ jobs:
       wif_provider: 'projects/763312321262/locations/global/workloadIdentityPools/gitsec-gha-artifacts/providers/gitsec-gha-artifacts-provider'
       zizmor_result_bucket: 'zizmor-43e4'
       zizmor_config_bucket: 'zizmor-configs-06f3'
-      zizmor_enforce: 'true'
+      zizmor_enforce: 'false'