From 4eda055b4e0712d3b44429a59bc40f9b3a0a5962 Mon Sep 17 00:00:00 2001 From: Andrew Ferrazzutti Date: Wed, 10 Jun 2026 09:37:45 -0400 Subject: [PATCH 1/7] Analyze GitHub Actions with zizmor --- .github/workflows/actions-lint.yml | 23 +++++++++++++++++++++++ .github/workflows/docs.yml | 3 +++ .github/workflows/lint.yml | 4 +++- .github/workflows/newsfile.yml | 1 + .github/workflows/npm-publish.yml | 2 ++ .github/workflows/tests.yml | 4 +++- 6 files changed, 35 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/actions-lint.yml diff --git a/.github/workflows/actions-lint.yml b/.github/workflows/actions-lint.yml new file mode 100644 index 0000000..0eecd35 --- /dev/null +++ b/.github/workflows/actions-lint.yml @@ -0,0 +1,23 @@ +name: Lint GitHub Actions + +on: + push: + branches: [ develop ] + pull_request: + branches: [ develop ] + +permissions: {} + +jobs: + zizmor: + runs-on: ubuntu-24.04 + permissions: + security-events: write + steps: + - name: Checkout repository + uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + with: + persist-credentials: false + + - name: Run zizmor 🌈 + uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 0502ddf..f446819 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -11,6 +11,8 @@ jobs: container: node:24 steps: - uses: actions/checkout@v3 + with: + persist-credentials: false - name: Get Package Version id: package-version @@ -34,6 +36,7 @@ jobs: uses: actions/checkout@v3 with: ref: gh-pages + persist-credentials: false # update the index file - env: diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 4486a8f..5da9bcd 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -11,9 +11,11 @@ jobs: runs-on: ubuntu-24.04 steps: - uses: actions/checkout@v2 + with: + persist-credentials: false - name: Use Node.js uses: actions/setup-node@v3 with: node-version-file: .node-version - run: yarn --ignore-scripts --strict-semver --pure-lockfile - - run: yarn lint \ No newline at end of file + - run: yarn lint diff --git a/.github/workflows/newsfile.yml b/.github/workflows/newsfile.yml index 8fdb979..52a954f 100644 --- a/.github/workflows/newsfile.yml +++ b/.github/workflows/newsfile.yml @@ -12,6 +12,7 @@ jobs: - uses: actions/checkout@v2 with: # Needed for comparison fetch-depth: 0 + persist-credentials: false - uses: actions/setup-python@v2 - run: pip install 'towncrier>=23.6.0' - name: ":newspaper: Newsfile" diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index e0f5991..be439f5 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -12,6 +12,8 @@ jobs: id-token: write steps: - uses: actions/checkout@v3 + with: + persist-credentials: false - name: Use Node.js uses: actions/setup-node@v3 with: diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 87f87fc..fe19e2b 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -14,9 +14,11 @@ jobs: node_version: [24, 26] steps: - uses: actions/checkout@v2 + with: + persist-credentials: false - name: Use Node.js uses: actions/setup-node@v3 with: node-version: "${{ matrix.node_version }}" - run: yarn --ignore-scripts --pure-lockfile - - run: yarn test \ No newline at end of file + - run: yarn test From 3ab22d68f6272bbf03add70f10833270a7e74d9b Mon Sep 17 00:00:00 2001 From: Andrew Ferrazzutti Date: Wed, 10 Jun 2026 09:57:49 -0400 Subject: [PATCH 2/7] Update and pin remote actions --- .github/workflows/actions-lint.yml | 2 +- .github/workflows/docs.yml | 10 +++++----- .github/workflows/lint.yml | 4 ++-- .github/workflows/newsfile.yml | 4 ++-- .github/workflows/npm-publish.yml | 4 ++-- .github/workflows/sign-off.yml | 2 +- .github/workflows/tests.yml | 4 ++-- .github/workflows/triage-incoming.yml | 2 +- 8 files changed, 16 insertions(+), 16 deletions(-) diff --git a/.github/workflows/actions-lint.yml b/.github/workflows/actions-lint.yml index 0eecd35..3e64a85 100644 --- a/.github/workflows/actions-lint.yml +++ b/.github/workflows/actions-lint.yml @@ -15,7 +15,7 @@ jobs: security-events: write steps: - name: Checkout repository - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index f446819..0d8faed 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -10,13 +10,13 @@ jobs: runs-on: ubuntu-24.04 container: node:24 steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Get Package Version id: package-version - uses: martinbeentjes/npm-get-version-action@master + uses: martinbeentjes/npm-get-version-action@3cf273023a0dda27efcd3164bdfb51908dd46a5b # v1.3.1 - run: yarn --frozen-lockfile @@ -24,7 +24,7 @@ jobs: - name: Deploy v${{ steps.package-version.outputs.current-version }} # This step will copy over generated docs to gh-pages branch, commit and publish - uses: peaceiris/actions-gh-pages@v3 + uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0 with: github_token: ${{ secrets.GITHUB_TOKEN }} keep_files: true @@ -33,7 +33,7 @@ jobs: full_commit_message: Deploy ${{ steps.package-version.outputs.current-version }} to GitHub Pages - name: Checkout gh-pages - uses: actions/checkout@v3 + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: ref: gh-pages persist-credentials: false @@ -44,7 +44,7 @@ jobs: run: node insert-new-version.js "${CURRENT_VERSION}" - name: Commit updated index - uses: github-actions-x/commit@v2.9 + uses: github-actions-x/commit@722d56b8968bf00ced78407bbe2ead81062d8baa # v2.9 with: github-token: ${{ secrets.GITHUB_TOKEN }} push-branch: 'gh-pages' diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 5da9bcd..e2c8e3f 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -10,11 +10,11 @@ jobs: lint: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Use Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version-file: .node-version - run: yarn --ignore-scripts --strict-semver --pure-lockfile diff --git a/.github/workflows/newsfile.yml b/.github/workflows/newsfile.yml index 52a954f..97f52fa 100644 --- a/.github/workflows/newsfile.yml +++ b/.github/workflows/newsfile.yml @@ -9,11 +9,11 @@ jobs: changelog: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: # Needed for comparison fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@v2 + - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 - run: pip install 'towncrier>=23.6.0' - name: ":newspaper: Newsfile" run: ./scripts/check-newsfragment diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index be439f5..76bbc98 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -11,11 +11,11 @@ jobs: contents: write id-token: write steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Use Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version-file: .node-version registry-url: https://registry.npmjs.org/ diff --git a/.github/workflows/sign-off.yml b/.github/workflows/sign-off.yml index e0fbca2..308ec2c 100644 --- a/.github/workflows/sign-off.yml +++ b/.github/workflows/sign-off.yml @@ -6,4 +6,4 @@ on: jobs: signoff: - uses: matrix-org/backend-meta/.github/workflows/sign-off.yml@v1.4.1 + uses: matrix-org/backend-meta/.github/workflows/sign-off.yml@18beaf3c8e536108bd04d18e6c3dc40ba3931e28 # v2.0.3 diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index fe19e2b..97df786 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -13,11 +13,11 @@ jobs: matrix: node_version: [24, 26] steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: persist-credentials: false - name: Use Node.js - uses: actions/setup-node@v3 + uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 with: node-version: "${{ matrix.node_version }}" - run: yarn --ignore-scripts --pure-lockfile diff --git a/.github/workflows/triage-incoming.yml b/.github/workflows/triage-incoming.yml index acf7551..f085723 100644 --- a/.github/workflows/triage-incoming.yml +++ b/.github/workflows/triage-incoming.yml @@ -6,7 +6,7 @@ on: jobs: triage: - uses: matrix-org/backend-meta/.github/workflows/triage-incoming.yml@v1 + uses: matrix-org/backend-meta/.github/workflows/triage-incoming.yml@18beaf3c8e536108bd04d18e6c3dc40ba3931e28 # v2.0.3 with: project_id: 'PVT_kwDOAIB0Bs4AG0bY' content_id: ${{ github.event.issue.node_id }} From c12678ba075a6687f5d85e0979ac7b9c0001d72a Mon Sep 17 00:00:00 2001 From: Andrew Ferrazzutti Date: Wed, 10 Jun 2026 09:58:19 -0400 Subject: [PATCH 3/7] Use minimal workflow permissions --- .github/workflows/docs.yml | 2 ++ .github/workflows/lint.yml | 2 ++ .github/workflows/newsfile.yml | 2 ++ .github/workflows/npm-publish.yml | 3 ++- .github/workflows/sign-off.yml | 2 ++ .github/workflows/tests.yml | 2 ++ .github/workflows/triage-incoming.yml | 2 ++ 7 files changed, 14 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 0d8faed..9244477 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -5,6 +5,8 @@ on: types: [published] workflow_dispatch: +permissions: {} + jobs: docs: runs-on: ubuntu-24.04 diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index e2c8e3f..3813d9b 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -6,6 +6,8 @@ on: pull_request: branches: [ develop ] +permissions: {} + jobs: lint: runs-on: ubuntu-24.04 diff --git a/.github/workflows/newsfile.yml b/.github/workflows/newsfile.yml index 97f52fa..0b92e93 100644 --- a/.github/workflows/newsfile.yml +++ b/.github/workflows/newsfile.yml @@ -5,6 +5,8 @@ on: branches: [ develop ] workflow_dispatch: +permissions: {} + jobs: changelog: runs-on: ubuntu-24.04 diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 76bbc98..49ed781 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -4,11 +4,12 @@ on: release: types: [published] +permissions: {} + jobs: publish-to-npm: runs-on: ubuntu-24.04 permissions: - contents: write id-token: write steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 diff --git a/.github/workflows/sign-off.yml b/.github/workflows/sign-off.yml index 308ec2c..d4d503f 100644 --- a/.github/workflows/sign-off.yml +++ b/.github/workflows/sign-off.yml @@ -4,6 +4,8 @@ on: pull_request: types: [opened, edited, synchronize] +permissions: {} + jobs: signoff: uses: matrix-org/backend-meta/.github/workflows/sign-off.yml@18beaf3c8e536108bd04d18e6c3dc40ba3931e28 # v2.0.3 diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 97df786..96a69a9 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -6,6 +6,8 @@ on: pull_request: branches: [ develop ] +permissions: {} + jobs: test: runs-on: ubuntu-24.04 diff --git a/.github/workflows/triage-incoming.yml b/.github/workflows/triage-incoming.yml index f085723..9115885 100644 --- a/.github/workflows/triage-incoming.yml +++ b/.github/workflows/triage-incoming.yml @@ -4,6 +4,8 @@ on: issues: types: [opened] +permissions: {} + jobs: triage: uses: matrix-org/backend-meta/.github/workflows/triage-incoming.yml@18beaf3c8e536108bd04d18e6c3dc40ba3931e28 # v2.0.3 From bd5c4fd658fb6a87998341027b5d9bb760417863 Mon Sep 17 00:00:00 2001 From: Andrew Ferrazzutti Date: Wed, 10 Jun 2026 10:15:03 -0400 Subject: [PATCH 4/7] Pin Node container for docs CI job --- .github/workflows/docs.yml | 2 +- .github/workflows/npm-publish.yml | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 9244477..67e76d5 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -10,7 +10,7 @@ permissions: {} jobs: docs: runs-on: ubuntu-24.04 - container: node:24 + container: node@sha256:8530f76a96d88820d288761f022e318970dda93d01536919fbc16076b7983e63 # 24 steps: - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 with: diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 49ed781..bb50960 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -20,6 +20,7 @@ jobs: with: node-version-file: .node-version registry-url: https://registry.npmjs.org/ + package-manager-cache: false - name: Upgrade npm for Trusted Publishing run: npm i -g npm@latest - run: yarn --strict-semver --frozen-lockfile From adcfdf93de0f19cf35d137086fc8b3ff275e26d5 Mon Sep 17 00:00:00 2001 From: Andrew Ferrazzutti Date: Wed, 10 Jun 2026 10:30:08 -0400 Subject: [PATCH 5/7] Add changelog --- changelog.d/81.misc | 1 + 1 file changed, 1 insertion(+) create mode 100644 changelog.d/81.misc diff --git a/changelog.d/81.misc b/changelog.d/81.misc new file mode 100644 index 0000000..6d1e378 --- /dev/null +++ b/changelog.d/81.misc @@ -0,0 +1 @@ +Analyze GitHub Actions with [zizmor](https://zizmor.sh/). From 5a391182ab97ede8ad0ad21dc123868ab99f58c1 Mon Sep 17 00:00:00 2001 From: Andrew Ferrazzutti Date: Thu, 2 Jul 2026 16:13:20 -0400 Subject: [PATCH 6/7] Update remote actions & container images again --- .github/workflows/actions-lint.yml | 4 ++-- .github/workflows/docs.yml | 6 +++--- .github/workflows/lint.yml | 2 +- .github/workflows/newsfile.yml | 4 ++-- .github/workflows/npm-publish.yml | 2 +- .github/workflows/tests.yml | 2 +- 6 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/actions-lint.yml b/.github/workflows/actions-lint.yml index 3e64a85..79ddb0c 100644 --- a/.github/workflows/actions-lint.yml +++ b/.github/workflows/actions-lint.yml @@ -15,9 +15,9 @@ jobs: security-events: write steps: - name: Checkout repository - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Run zizmor 🌈 - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6 + uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7 diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml index 67e76d5..f8678a8 100644 --- a/.github/workflows/docs.yml +++ b/.github/workflows/docs.yml @@ -10,9 +10,9 @@ permissions: {} jobs: docs: runs-on: ubuntu-24.04 - container: node@sha256:8530f76a96d88820d288761f022e318970dda93d01536919fbc16076b7983e63 # 24 + container: node@sha256:fdddfb3e688158251943d52eba361de991548f6814007acba4917ae6b512d6be # 24 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false @@ -35,7 +35,7 @@ jobs: full_commit_message: Deploy ${{ steps.package-version.outputs.current-version }} to GitHub Pages - name: Checkout gh-pages - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: ref: gh-pages persist-credentials: false diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 3813d9b..45108ab 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -12,7 +12,7 @@ jobs: lint: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Use Node.js diff --git a/.github/workflows/newsfile.yml b/.github/workflows/newsfile.yml index 0b92e93..7dba532 100644 --- a/.github/workflows/newsfile.yml +++ b/.github/workflows/newsfile.yml @@ -11,11 +11,11 @@ jobs: changelog: runs-on: ubuntu-24.04 steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: # Needed for comparison fetch-depth: 0 persist-credentials: false - - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0 + - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 - run: pip install 'towncrier>=23.6.0' - name: ":newspaper: Newsfile" run: ./scripts/check-newsfragment diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index bb50960..36467a9 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -12,7 +12,7 @@ jobs: permissions: id-token: write steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Use Node.js diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index 96a69a9..da5e400 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -15,7 +15,7 @@ jobs: matrix: node_version: [24, 26] steps: - - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: persist-credentials: false - name: Use Node.js From 6e9d10dbf556c0d76513ba2dd6a88e69d641dc27 Mon Sep 17 00:00:00 2001 From: Andrew Ferrazzutti Date: Thu, 2 Jul 2026 16:14:33 -0400 Subject: [PATCH 7/7] Add another changelog for action & image updates --- changelog.d/81.misc.1 | 1 + 1 file changed, 1 insertion(+) create mode 100644 changelog.d/81.misc.1 diff --git a/changelog.d/81.misc.1 b/changelog.d/81.misc.1 new file mode 100644 index 0000000..98ef986 --- /dev/null +++ b/changelog.d/81.misc.1 @@ -0,0 +1 @@ +Update and pin remote GitHub Actions and container images.