From 607237e2c51b654e860bf8c8821c63f0170f7d43 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 1 Nov 2026 10:37:47 +0000 Subject: [PATCH 1/4] ci: lint GitHub Actions workflows with zizmor Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/test.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 861643a..eac7bd8 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -93,3 +93,20 @@ jobs: persist-credentials: false - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - run: pnpm run knip + + zizmor: + name: Lint GitHub Actions + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + - name: Run zizmor + uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0 + with: + # Pinned so CI doesn't turn red when a new zizmor release adds audits; bump deliberately + version: 1.31.1 + # Report as annotations and fail the job, instead of uploading SARIF to code scanning + # (which would need the security-events: write permission) + advanced-security: false + annotations: true From fe2f842e9fe527cb3266d06e59806b5e6ca6df7c Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 1 Nov 2026 10:52:01 +0000 Subject: [PATCH 2/4] ci: fix zizmor findings in existing workflows Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/dependency-diff.yml | 10 +++++----- .github/workflows/pkg-pr-new.yml | 8 +++++--- .github/workflows/release.yml | 14 +++++++------- .github/workflows/test.yml | 8 ++++---- 4 files changed, 21 insertions(+), 19 deletions(-) diff --git a/.github/workflows/dependency-diff.yml b/.github/workflows/dependency-diff.yml index 86a0f77..da334cf 100644 --- a/.github/workflows/dependency-diff.yml +++ b/.github/workflows/dependency-diff.yml @@ -11,12 +11,12 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: ref: main persist-credentials: false - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 22 cache: pnpm @@ -34,11 +34,11 @@ jobs: permissions: contents: read steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 22 cache: pnpm @@ -58,7 +58,7 @@ jobs: contents: read pull-requests: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: fetch-depth: 0 persist-credentials: false diff --git a/.github/workflows/pkg-pr-new.yml b/.github/workflows/pkg-pr-new.yml index b9d9992..9d34315 100644 --- a/.github/workflows/pkg-pr-new.yml +++ b/.github/workflows/pkg-pr-new.yml @@ -49,7 +49,9 @@ jobs: id: check # Exactly one of the three steps above runs per trigger, the others are # skipped and their outputs are empty strings, so this picks whichever ran. - run: echo "approved=${{ steps.push-approved.outputs.approved || steps.checkAuthor.outputs.require-result || steps.checkPermissions.outputs.require-result }}" >> "$GITHUB_OUTPUT" + env: + APPROVED: ${{ steps.push-approved.outputs.approved || steps.checkAuthor.outputs.require-result || steps.checkPermissions.outputs.require-result }} + run: echo "approved=${APPROVED}" >> "$GITHUB_OUTPUT" build: name: Build @@ -69,7 +71,7 @@ jobs: - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - cache: pnpm + package-manager-cache: false - run: pnpm install --frozen-lockfile - run: pnpm run build - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2 @@ -96,7 +98,7 @@ jobs: - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 - cache: pnpm + package-manager-cache: false - run: pnpm install --frozen-lockfile --ignore-scripts - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2 with: diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 13d1537..a0b129a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,11 +11,11 @@ jobs: runs-on: ubuntu-latest permissions: {} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false @@ -27,11 +27,11 @@ jobs: runs-on: ubuntu-latest permissions: {} steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false @@ -48,7 +48,7 @@ jobs: permissions: contents: write steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: true - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 @@ -75,11 +75,11 @@ jobs: permissions: id-token: write # Required for OIDC provenance steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6 + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 + - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: node-version: 24 package-manager-cache: false diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index eac7bd8..1aa4c14 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -19,7 +19,7 @@ jobs: persist-credentials: false - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - name: Use Node.js - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: cache: 'pnpm' node-version: 24 @@ -35,7 +35,7 @@ jobs: persist-credentials: false - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - name: Use Node.js - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: cache: 'pnpm' node-version: 24 @@ -51,7 +51,7 @@ jobs: persist-credentials: false - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - name: Use Node.js - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: cache: 'pnpm' node-version: 24 @@ -67,7 +67,7 @@ jobs: persist-credentials: false - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0 - name: Use Node.js - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v6 + uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0 with: cache: 'pnpm' node-version: 24 From 0295c1bd8a129b9c951d85fba907200ae5b26b33 Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 1 Nov 2026 10:53:01 +0000 Subject: [PATCH 3/4] ci: acknowledge pkg-pr-new publish in zizmor Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/pkg-pr-new.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/pkg-pr-new.yml b/.github/workflows/pkg-pr-new.yml index 9d34315..302b756 100644 --- a/.github/workflows/pkg-pr-new.yml +++ b/.github/workflows/pkg-pr-new.yml @@ -104,6 +104,8 @@ jobs: with: name: dist path: dist/ + # pkg-pr-new publishes previews through its own GitHub App, not to npm, so there is + # no npm token to replace with trusted publishing. # --commentWithSha uses the commit sha in install URLs/comments instead # of a PR number, and pnpm exec (not npx/dlx) runs the pinned devDependency. - - run: pnpm exec pkg-pr-new publish --commentWithSha + - run: pnpm exec pkg-pr-new publish --commentWithSha # zizmor: ignore[use-trusted-publishing] From 5dfbbf5abc8696577bab48a32b9501c7a1072ccf Mon Sep 17 00:00:00 2001 From: Claude Date: Sun, 1 Nov 2026 10:54:37 +0000 Subject: [PATCH 4/4] ci: format zizmor ignore comment Co-Authored-By: Claude Sonnet 5.5 --- .github/workflows/pkg-pr-new.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/pkg-pr-new.yml b/.github/workflows/pkg-pr-new.yml index 302b756..02bc5db 100644 --- a/.github/workflows/pkg-pr-new.yml +++ b/.github/workflows/pkg-pr-new.yml @@ -108,4 +108,4 @@ jobs: # no npm token to replace with trusted publishing. # --commentWithSha uses the commit sha in install URLs/comments instead # of a PR number, and pnpm exec (not npx/dlx) runs the pinned devDependency. - - run: pnpm exec pkg-pr-new publish --commentWithSha # zizmor: ignore[use-trusted-publishing] + - run: pnpm exec pkg-pr-new publish --commentWithSha # zizmor: ignore[use-trusted-publishing]