From 145dec88bfc0e798322b90d41944a2de22b736c7 Mon Sep 17 00:00:00 2001
From: Alexander Brandon Coles <a.coles@openproject.com>
Date: Tue, 18 Aug 2026 12:55:10 +0100
Subject: [PATCH] ci: scan workflows with zizmor

Mirrors the zizmor-scan workflow used by openproject-octicons and
primer_view_components: pull requests that touch workflow files get
audited, with results uploaded to code scanning.

Getting to a clean run needed two changes to the existing workflows.
zizmor's blanket policy wants actions pinned to a commit hash, so every
uses: now carries a SHA with the tag in a trailing comment; Dependabot
updates both together. Checkout also drops its credentials, which the
test workflow never needed and which changesets/action does not use
either, since it pushes through the GitHub API.

The scan workflow itself pins checkout to the same v7 as the rest of the
repo rather than the v6 the sibling repos use, and takes the current
zizmor-action release.
---
 .github/workflows/release.yml     | 11 +++++++----
 .github/workflows/test.yml        |  6 ++++--
 .github/workflows/zizmor-scan.yml | 27 +++++++++++++++++++++++++++
 3 files changed, 38 insertions(+), 6 deletions(-)
 create mode 100644 .github/workflows/zizmor-scan.yml

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2870182..6a54c74 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,21 +15,24 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Full history so changesets can generate changelogs with the
           # correct commits.
           fetch-depth: 0
-      - uses: oven-sh/setup-bun@v2
+          # changesets/action pushes through the GitHub API rather than the
+          # git CLI, so it does not need the checkout credentials.
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       # changeset publish shells out to npm, which handles the OIDC token
       # exchange with the registry (npm >= 11.5.1, bundled with Node 24).
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
       - run: bun install --frozen-lockfile
       - name: Create Release PR or publish
-        uses: changesets/action@v2
+        uses: changesets/action@198f833dd7d863100ea6e28967bc9a9fdefadb0a # v2.1.0
         with:
           # changesets/action v2 renamed these inputs.
           pr-title: Release Tracking
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index a690f1b..6395eda 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,8 +12,10 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: oven-sh/setup-bun@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       - run: bun install --frozen-lockfile
       - run: bunx playwright install chromium --with-deps
       - run: bun run test
diff --git a/.github/workflows/zizmor-scan.yml b/.github/workflows/zizmor-scan.yml
new file mode 100644
index 0000000..016e876
--- /dev/null
+++ b/.github/workflows/zizmor-scan.yml
@@ -0,0 +1,27 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2