chore: harden GH workflows

[jkowalleck]

• add zizmor
• annotate actions
• use native gh release

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	✅ 0 (≤ 20 complexity)
Duplication	0

View in Codacy

🟢 Coverage ∅ diff coverage

Metric	Results
Coverage variation	Report missing for 77395231
Diff coverage	✅ ∅ diff coverage (80.00%)

View coverage diff in Codacy

Coverage variation details

	Coverable lines	Covered lines	Coverage
Common ancestor commit (7739523)	Report Missing	Report Missing	Report Missing
Head commit (95db617)	2895	2691	92.95%

Coverage variation is the difference between the coverage for the head and common ancestor commits of the pull request branch: <coverage of head commit> - <coverage of common ancestor commit>

Diff coverage details

	Coverable lines	Covered lines	Diff coverage
Pull request (#1585)	0	0	∅ (not applicable)

Diff coverage is the percentage of lines that are covered by tests out of the coverable lines that the pull request added or modified: <covered lines added or modified>/<coverable lines added or modified> * 100%

¹ Codacy didn't receive coverage data for the commit, or there was an error processing the received data. Check your integration for errors and validate that your coverage setup is correct.

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

Pull request overview

Hardens the repository’s GitHub automation by tightening workflow permissions/credentials, pinning/annotating third-party actions, and adding automated workflow security scanning via zizmor.

Changes:

• Add a new Zizmor workflow to analyze GitHub Actions workflows for security issues with least-privilege permissions.
• Harden existing CI/release workflows by pinning action versions more explicitly and disabling persisted checkout credentials.
• Replace the GitHub release creation action with native gh release create.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/zizmor.yml	Adds a scheduled/PR zizmor scan job with minimal permissions and pinned actions.
.github/workflows/release.yml	Hardens checkout configuration, updates action pins, and switches release creation to gh release create.
.github/workflows/nodejs.yml	Hardens checkout configuration, updates action pins, and adds a zizmor ignore annotation.
.github/dependabot.yml	Adds a Dependabot cooldown window to reduce rapid-update risk/noise.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (2)

.github/workflows/release.yml:96

• workflow_dispatch can be run from either a branch or a tag. If it is triggered from a tag ref, GITHUB_REF_NAME will be the tag name and this push will attempt to create/update a branch with that tag name (or fail), which is very likely unintended for a release workflow. Add an explicit guard to ensure the workflow is run from refs/heads/* before pushing back to the repository.

          AUTH_B64="$(printf "x-access-token:%s" "$GITHUB_TOKEN" | base64 | tr -d '\n')"
          echo "::add-mask::$AUTH_B64"
          git -c http.https://github.com/.extraheader="AUTHORIZATION: basic $AUTH_B64" \
            push --follow-tags "https://github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF_NAME}"

.github/workflows/nodejs.yml:189

• The zizmor suppression comment says the packages are already locked and uses "dont". This repo doesn't have a root lockfile, so the justification is misleading here; it would be clearer to state that CI intentionally installs packages without a lockfile and avoids writing ad-hoc deps to the manifest.

        run: |  # zizmor: ignore[adhoc-packages] -- packages are already locked, but we dont want to alter manifest

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (2)

.github/workflows/nodejs.yml:189

• Typo in comment: "dont" → "don't".

        run: |  # zizmor: ignore[adhoc-packages] -- packages are already locked, but we dont want to alter manifest

.github/workflows/release.yml:195

• gh release create is invoked without --notes/--generate-notes/--notes-from-tag. In CI this commonly triggers an interactive editor prompt and can hang or fail the workflow.

          gh release create "${TAG_NAME}" \
            "${ASSETS_DIR}"/* \
            --title "${RELEASE_NAME}" \
            --target "${TARGET_COMMITISH}" \
            ${prerelease_flag}