rules:
  dangerous-triggers:
    ignore:
      # this workflow is only triggered after maintainer approval
      - upload_pr_documentation.yml:3:1
  cache-poisoning:
    ignore:
      # the docker buildx binary is cached and zizmor warns about a cache poisoning attack.
      # OTOH this cache would make us more resilient against an intrusion on docker-buildx' side.
      # There is no obvious benefit so we leave it as it is.
      - build_docker_images.yml:37:9
      - build_docker_images.yml:70:9
      - build_docker_images.yml:103:9
      - build_docker_images.yml:136:9
      - build_docker_images.yml:169:9
  unpinned-images:
    ignore:
      # We want to test these images with the latest version and we're not using them
      # to deploy anything so we deem it safe to use those, even if they are unpinned.
      - nightly-bnb.yml:30:7
      - nightly-bnb.yml:155:7
      - nightly.yml:27:7
      - nightly.yml:77:7
      - torch_compile_tests.yml:32:7
