ci: harden GitHub Actions workflows#109

Merged

flavorjones merged 8 commits intomasterfrom

harden-github-actions

Mar 20, 2026

Commits on Mar 20, 2026

ci: add zizmor and actionlint CI job to test workflow

flavorjones
and
claude
committed
ci: increase dependabot cooldown for github-actions to 7 days

flavorjones
and
claude
committed
ci: add lint-actions target and tool installation to Makefile

flavorjones
and
claude
committed
ci: pin all actions to SHA hashes with version comments

flavorjones
and
claude
committed
ci: resolve all high-severity zizmor findings

flavorjones
and
claude
committed
ci: resolve all low-severity zizmor findings

flavorjones
and
claude
committed
ci: move workflow-level permissions to job-level only

flavorjones
and
claude
committed
ci: ensure all permissions are scoped to job-level

flavorjones
and
claude
committed