Add actionci.yml (#106)

* Add actionci.yml

Add caller workflow for actionci (actionlint + zizmor + frizbee).
Add permissions blocks and zizmor suppression config.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Suppress dependabot-cooldown in zizmor config

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Fix zizmor errors: pin actions, fix bot-conditions, deduplicate permissions

- Pin unpinned actions to SHA digests via frizbee
- Fix spoofable bot actor checks (github.actor → github.event.pull_request.user.login)
- Remove duplicate permissions blocks
- Suppress low-confidence cache-poisoning findings
- Pin postgres container image

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add permissions to triage.yml to fix zizmor excessive-permissions warning

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: tashian

.github/workflows/actionci.yml

@@ -0,0 +1,22 @@
+name: Action CI
+
+on:
+  push:
+    tags-ignore:
+    - 'v*'
+    branches:
+    - "master"
+  pull_request:
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  actionci:
+    permissions:
+      contents: read
+      security-events: write
+    uses: smallstep/workflows/.github/workflows/actionci.yml@main
+    secrets: inherit

.github/workflows/ci.yml

@@ -9,8 +9,15 @@ on:
   pull_request:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   ci:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     uses: smallstep/workflows/.github/workflows/goCI.yml@main
     with:
       only-latest-golang: false

.github/workflows/code-scan-cron.yml

@@ -2,6 +2,11 @@ on:
   schedule:
     - cron: '0 0 * * SUN'
 
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
 jobs:
   code-scan:
     uses: smallstep/workflows/.github/workflows/code-scan.yml@main

.github/workflows/dependabot-auto-merge.yml

@@ -8,11 +8,11 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1.1.1
+        uses: dependabot/fetch-metadata@a3e5f86ae9f2f49b441498973ddec20035d326b8 # v1.1.1
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Enable auto-merge for Dependabot PRs

.github/workflows/triage.yml

@@ -12,5 +12,9 @@ on:
 
 jobs:
   triage:
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
     uses: smallstep/workflows/.github/workflows/triage.yml@main
     secrets: inherit

.github/zizmor.yml

@@ -0,0 +1,14 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "smallstep/*": ref-pin
+  secrets-inherit:
+    disable: true
+  ref-confusion:
+    disable: true
+  dangerous-triggers:
+    ignore:
+      - triage.yml
+  dependabot-cooldown:
+    disable: true