From 77d726a8ea769043a1ac8b042007cb35240c2466 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 11:45:51 -0400 Subject: [PATCH 1/5] Pin actions to SHA hashes with pinact Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/ai-breaking-change.yml | 2 +- .github/workflows/ai-classify-pr.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ai-breaking-change.yml b/.github/workflows/ai-breaking-change.yml index a20b7a2..1020087 100644 --- a/.github/workflows/ai-breaking-change.yml +++ b/.github/workflows/ai-breaking-change.yml @@ -34,7 +34,7 @@ jobs: breaking: ${{ steps.parse.outputs.breaking }} items: ${{ steps.parse.outputs.items }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Filter diff id: filter diff --git a/.github/workflows/ai-classify-pr.yml b/.github/workflows/ai-classify-pr.yml index 977d3ee..9e1088e 100644 --- a/.github/workflows/ai-classify-pr.yml +++ b/.github/workflows/ai-classify-pr.yml @@ -27,7 +27,7 @@ jobs: outputs: label: ${{ steps.validate.outputs.label }} steps: - - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - name: Build prompt env: From f5b291134d72059543153b5077e76a71005074c4 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 11:46:18 -0400 Subject: [PATCH 2/5] Fix artipacked: add persist-credentials: false to checkout steps Neither workflow does git push, so credentials don't need to be persisted. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/ai-breaking-change.yml | 2 ++ .github/workflows/ai-classify-pr.yml | 2 ++ 2 files changed, 4 insertions(+) diff --git a/.github/workflows/ai-breaking-change.yml b/.github/workflows/ai-breaking-change.yml index 1020087..f795671 100644 --- a/.github/workflows/ai-breaking-change.yml +++ b/.github/workflows/ai-breaking-change.yml @@ -35,6 +35,8 @@ jobs: items: ${{ steps.parse.outputs.items }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Filter diff id: filter diff --git a/.github/workflows/ai-classify-pr.yml b/.github/workflows/ai-classify-pr.yml index 9e1088e..8739d01 100644 --- a/.github/workflows/ai-classify-pr.yml +++ b/.github/workflows/ai-classify-pr.yml @@ -28,6 +28,8 @@ jobs: label: ${{ steps.validate.outputs.label }} steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false - name: Build prompt env: From daed2f65a2e98086175311f5b020f8febef7c459 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 11:47:07 -0400 Subject: [PATCH 3/5] Fix actionlint: suppress SC2016 false positive for markdown backticks The backticks in the FOOTER string are literal markdown characters, not shell command substitution. SC2016 fires because shellcheck sees backticks inside single quotes and warns, but this is intentional. Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/sensitive-change-gate.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/sensitive-change-gate.yml b/.github/workflows/sensitive-change-gate.yml index a57c859..63aef57 100644 --- a/.github/workflows/sensitive-change-gate.yml +++ b/.github/workflows/sensitive-change-gate.yml @@ -91,6 +91,7 @@ jobs: FOOTER='> **Shadow mode** — this check is informational only. When activated, changes to these paths will require approval from a maintainer.' else HEADER="Sensitive Change Detection" + # shellcheck disable=SC2016 FOOTER='> Changes to control-plane files require approval from a maintainer. Add the `sensitive-change-approved` label to proceed.' fi From 651ad4ce17c30cd245a2f79db9413ca7cdf4332a Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 11:47:30 -0400 Subject: [PATCH 4/5] Add CI workflow with GitHub Actions audit (actionlint + zizmor) Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/ci.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..c4bb99e --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,26 @@ +name: CI + +on: + push: + branches: [main] + pull_request: + +jobs: + lint-actions: + name: GitHub Actions audit + runs-on: ubuntu-latest + permissions: + contents: read + + steps: + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run actionlint + uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11 + + - name: Run zizmor + uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2 + with: + advanced-security: false From bf2bbbaae8d147d63fab9ffb1ebd065890ce90cc Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 11:47:38 -0400 Subject: [PATCH 5/5] Configure dependabot for github-actions with weekly batched updates Co-Authored-By: Claude Sonnet 4.6 --- .github/dependabot.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..066427b --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,12 @@ +version: 2 +updates: + - package-ecosystem: github-actions + directory: "/" + groups: + github-actions: + patterns: + - "*" + schedule: + interval: weekly + cooldown: + default-days: 7