Add zizmor integration

.changeset/gentle-grapes-sleep.md

@@ -0,0 +1,5 @@
+---
+"@zemd/gha": patch
+---
+
+Add zizmor integration

.github/dependabot.yml

@@ -13,6 +13,12 @@ updates:
       - "/internal/*"
     schedule:
       interval: "weekly"
+    # Match pnpm's release-age policy for npm packages.
+    cooldown:
+      default-days: 7 # pnpm-workspace.yaml: minimumReleaseAge / 1440
+      # Keep exemptions aligned with pnpm-workspace.yaml.
+      exclude:
+        - "@zemd/*"
     versioning-strategy: "increase" # the workspace pins exact versions (saveExact)
     open-pull-requests-limit: 10
     groups:
@@ -24,6 +30,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 10
     groups:
       github-actions:

.github/workflows-examples/README.md

@@ -8,6 +8,7 @@ Copy-paste callers for the reusable workflows published from this repository.
 | [`release.yml`](./release.yml)       | `shared-release.yml`   | Release pull request, npm publish, git tags, GitHub release                |
 | [`codeql.yml`](./codeql.yml)         | `shared-codeql.yml`    | CodeQL analysis                                                            |
 | [`scorecard.yml`](./scorecard.yml)   | `shared-scorecard.yml` | OpenSSF Scorecard                                                          |
+| [`zizmor.yml`](./zizmor.yml)         | `shared-zizmor.yml`    | Blocking security lint for GitHub Actions and Dependabot                   |
 | [`dependabot.yml`](./dependabot.yml) | —                      | Keeps the pinned SHAs current                                              |
 
 They assume a pnpm workspace with `lint-check`, `format-check`, `typecheck`,
@@ -17,7 +18,7 @@ those can be renamed or disabled through workflow inputs — see the commented
 
 ## Install
 
-1. Copy the four workflow files into `.github/workflows/` of the target
+1. Copy the five workflow files into `.github/workflows/` of the target
    repository and `dependabot.yml` into `.github/`.
 
 2. Replace the `__SHA__` placeholder with the commit of the release you want:
@@ -72,6 +73,9 @@ For npm **trusted publishing**:
   the same `concurrency.group` on both sides with `cancel-in-progress: true`.
 - Permissions can only be narrowed by the called workflow, never widened, which
   is why each example declares them on the calling job.
+- `shared-zizmor.yml` deliberately uses annotation output instead of SARIF so
+  any finding fails the job. Its weekly caller also catches advisories published
+  after an action was pinned; CodeQL remains the stateful code-scanning feed.
 - `shared-release.yml` checks out the explicit `shared-tooling-repository` and
   `shared-tooling-ref` into `.shared-ci/` to reach the bundled `gha.mjs` CLI.
   Keep the ref equal to the SHA that pins the reusable workflow. The checkout is

.github/workflows-examples/codeql.yml

@@ -22,8 +22,8 @@ jobs:
     name: CodeQL
     uses: zemd/js/.github/workflows/shared-codeql.yml@__SHA__ # v1
     permissions:
-      contents: read
-      actions: read
-      security-events: write
+      contents: read # checkout the repository for analysis
+      actions: read # let CodeQL read workflow-run metadata
+      security-events: write # upload results to code scanning
     # with:
     #   languages: '["actions", "javascript-typescript"]'

.github/workflows-examples/dependabot.yml

@@ -6,6 +6,12 @@ updates:
       - "/packages/*"
     schedule:
       interval: "weekly"
+    # Match pnpm's release-age policy for npm packages.
+    cooldown:
+      default-days: 7 # pnpm-workspace.yaml: minimumReleaseAge / 1440
+      # Keep exemptions aligned with pnpm-workspace.yaml.
+      exclude:
+        - "@zemd/*"
     versioning-strategy: "increase" # the workspace pins exact versions (saveExact)
     open-pull-requests-limit: 10
     groups:
@@ -20,6 +26,8 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 10
     groups:
       github-actions:

.github/workflows-examples/release.yml

@@ -9,7 +9,11 @@ on:
     branches:
       - main
 
-concurrency: ${{ github.workflow }}-${{ github.ref }}
+# A release must finish once started; serialize runs without cancelling one that
+# may already be publishing packages or moving tags.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   release:

.github/workflows-examples/scorecard.yml

@@ -19,10 +19,10 @@ jobs:
     name: Scorecard
     uses: zemd/js/.github/workflows/shared-scorecard.yml@__SHA__ # v1
     permissions:
-      contents: read
-      actions: read
-      security-events: write
-      id-token: write
+      contents: read # checkout the repository for analysis
+      actions: read # inspect workflow runs for dangerous patterns
+      security-events: write # upload results to code scanning
+      id-token: write # publish results to the OpenSSF API
     # with:
     #   publish-results: true
     #   artifact-retention-days: 5

.github/workflows-examples/zizmor.yml

@@ -0,0 +1,29 @@
+name: zizmor
+
+permissions: {}
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    # Re-check pinned actions when new advisories or stale-reference data lands.
+    - cron: "13 6 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    name: zizmor
+    uses: zemd/js/.github/workflows/shared-zizmor.yml@__SHA__ # v1
+    permissions:
+      contents: read # checkout and online audits
+    # with:
+    #   audit-inputs: "."
+    #   persona: regular

.github/workflows/codeql.yml

@@ -22,6 +22,6 @@ jobs:
     name: CodeQL
     uses: ./.github/workflows/shared-codeql.yml
     permissions:
-      contents: read
-      actions: read
-      security-events: write
+      contents: read # checkout the repository for analysis
+      actions: read # let CodeQL read workflow-run metadata
+      security-events: write # upload results to code scanning

.github/workflows/release.yml

@@ -7,16 +7,20 @@ on:
     branches:
       - main
 
-concurrency: ${{ github.workflow }}-${{ github.ref }}
+# A release must finish once started; serialize runs without cancelling one that
+# may already be publishing packages or moving tags.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
 
 jobs:
   release:
     name: Release
     uses: ./.github/workflows/shared-release.yml
     permissions:
-      contents: write
-      pull-requests: write
-      id-token: write
+      contents: write # release branch, git tags and GitHub releases
+      pull-requests: write # open and refresh the release pull request
+      id-token: write # npm trusted publishing (OIDC)
     with:
       shared-tooling-repository: ${{ github.repository }}
       shared-tooling-ref: ${{ github.sha }}
@@ -31,7 +35,7 @@ jobs:
     if: needs.release.outputs.pending == 'false'
     runs-on: ubuntu-latest
     permissions:
-      contents: write
+      contents: write # publish the shared workflow tags and GitHub release
 
     steps:
       - name: Checkout Repo

.github/workflows/scorecard.yml

@@ -19,7 +19,7 @@ jobs:
     name: Scorecard
     uses: ./.github/workflows/shared-scorecard.yml
     permissions:
-      contents: read
-      actions: read
-      security-events: write
-      id-token: write
+      contents: read # checkout the repository for analysis
+      actions: read # inspect workflow runs for dangerous patterns
+      security-events: write # upload results to code scanning
+      id-token: write # publish results to the OpenSSF API

.github/workflows/shared-codeql.yml

@@ -19,9 +19,9 @@ jobs:
     name: "Analyze: ${{ matrix.language }}"
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      actions: read
-      security-events: write
+      contents: read # checkout the caller repository for analysis
+      actions: read # let CodeQL read workflow-run metadata
+      security-events: write # upload results to code scanning
 
     strategy:
       fail-fast: false

.github/workflows/shared-release.yml

@@ -73,8 +73,8 @@ jobs:
     name: Version
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
+      contents: write # create or update the release branch
+      pull-requests: write # open and refresh the release pull request
     outputs:
       pending: ${{ steps.version.outputs.pending }}
     steps:

.github/workflows/shared-scorecard.yml

@@ -23,12 +23,10 @@ jobs:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      # Read the workflow run history that the Dangerous-Workflow checks rely on.
-      actions: read
-      security-events: write
-      # Publish the result to the OpenSSF REST API.
-      id-token: write
+      contents: read # checkout the caller repository for analysis
+      actions: read # inspect workflow runs for dangerous patterns
+      security-events: write # upload results to code scanning
+      id-token: write # publish results to the OpenSSF REST API
 
     steps:
       - name: Checkout Repo

.github/workflows/shared-zizmor.yml

@@ -0,0 +1,47 @@
+name: Shared zizmor
+
+# Blocking GitHub Actions security linting for workflows, custom actions and
+# Dependabot configuration. Call it from a repository with:
+#   uses: zemd/js/.github/workflows/shared-zizmor.yml@<sha> # v1
+
+permissions: {}
+
+on:
+  workflow_call:
+    inputs:
+      audit-inputs:
+        description: Whitespace-separated repository paths for zizmor to audit.
+        type: string
+        default: "."
+      persona:
+        description: zizmor audit persona; regular is the recommended CI default.
+        type: string
+        default: "regular"
+
+jobs:
+  audit:
+    name: Audit GitHub Actions
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read # checkout and online audits, including private callers
+
+    steps:
+      - name: Checkout Repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      # Plain/annotation output preserves zizmor's non-zero finding exit codes.
+      # SARIF mode always exits zero for findings and is therefore not a merge gate.
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          inputs: ${{ inputs.audit-inputs }}
+          collect: default
+          online-audits: true
+          persona: ${{ inputs.persona }}
+          version: "1.29.0"
+          advanced-security: false
+          annotations: true
+          fail-on-no-inputs: true

.github/workflows/zizmor.yml

@@ -0,0 +1,30 @@
+name: zizmor
+
+permissions: {}
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  schedule:
+    # Re-check pinned actions when new advisories or stale-reference data lands.
+    - cron: "13 6 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    name: zizmor
+    uses: ./.github/workflows/shared-zizmor.yml
+    permissions:
+      contents: read # checkout and online audits
+    with:
+      # This provider keeps its own workflow contract free of code smells as
+      # well as regular security findings. Consumers default to regular.
+      persona: pedantic

.gitignore

@@ -35,3 +35,4 @@ yarn-error.log*
 
 # release
 pnpm-publish-summary.json
+.pnpm-store

README.md

@@ -58,8 +58,13 @@ All tasks are orchestrated by [Turborepo](https://turborepo.com) and run across
 | `pnpm format-check`       | Verify formatting without writing changes         |
 | `pnpm lint`               | Run type-aware linting and auto-fix with `oxlint` |
 | `pnpm lint-check`         | Run type-aware linting and fail on warnings       |
+| `pnpm lint-actions`       | Audit GitHub Actions with `zizmor`                |
 | `pnpm lint-publish`       | Validate publishable package metadata (`publint`) |
 
+`pnpm lint-actions` requires [`zizmor`](https://docs.zizmor.sh/installation/)
+1.29.0, matching the exact version pinned by CI. Set `GH_TOKEN` (for example,
+from `gh auth token`) to include online audits when running it locally.
+
 To run a script for a single package, use the workspace filter:
 
 ```sh
@@ -72,7 +77,7 @@ To report a vulnerability, follow [`SECURITY.md`](SECURITY.md).
 
 ## Contributing
 
-Issues and pull requests are welcome. Before opening a PR, please make sure that `pnpm lint-check`, `pnpm format-check`, `pnpm typecheck`, and `pnpm test` all pass.
+Issues and pull requests are welcome. Before opening a PR, please make sure that `pnpm lint-check`, `pnpm lint-actions`, `pnpm format-check`, `pnpm typecheck`, and `pnpm test` all pass.
 
 ## License