Improve CI security

.github/dependabot.yml

@@ -9,3 +9,5 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -9,6 +9,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   ci:
     name: Format, Lint, Test (${{ matrix.os }} / ${{ matrix.arch }})
@@ -37,10 +41,12 @@ jobs:
             runs_on: macos-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
 
       - name: Setup mise
-        uses: jdx/mise-action@v3
+        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3
 
       - name: Run CI
         run: mise run ci
@@ -72,10 +78,12 @@ jobs:
             runs_on: macos-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
 
       - name: Setup mise
-        uses: jdx/mise-action@v3
+        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3
 
       - name: Run end-to-end tests
         run: mise run e2e

.github/workflows/release.yml

@@ -21,6 +21,13 @@ on:
         type: boolean
         default: true
 
+# Default to empty. Set at job level below
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false # Don't stop in the middle of a release
+
 jobs:
   release:
     name: Build and Release
@@ -32,18 +39,21 @@ jobs:
     steps:
       # Clone
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
-          fetch-depth: 0  # Required for tag computation and goreleaser changelog
+          fetch-depth: 0 # Required for tag computation and goreleaser changelog
+          persist-credentials: true # Needed to push tags
 
       - name: Setup mise
-        uses: jdx/mise-action@v3
+        uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3
+        with:
+          cache: false
 
       # Python is needed for GoReleaser post-build hooks that create Python wheels
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
-          python-version: '3.13'
+          python-version: "3.13"
 
       # Dependencies used for wheel builds
       - name: Install Python build tools
@@ -63,17 +73,17 @@ jobs:
 
       # GoReleaser builds binaries, creates GitHub release, and runs post-build hooks
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
         with:
           distribution: goreleaser
-          version: '~> v2'
+          version: "~> v2"
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       # Upload wheels as artifacts for publishing jobs
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: wheels
           path: wheels/*.whl
@@ -103,16 +113,16 @@ jobs:
       name: testpypi
       url: https://test.pypi.org/p/uvbox
     permissions:
-      id-token: write
+      id-token: write # Required for trusted publishing on PyPI
     steps:
       - name: Download wheels
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: wheels
           path: wheels/
 
       - name: Publish to Test PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
         with:
           repository-url: https://test.pypi.org/legacy/
           packages-dir: wheels/
@@ -128,16 +138,16 @@ jobs:
       name: pypi
       url: https://pypi.org/p/uvbox
     permissions:
-      id-token: write
+      id-token: write # Required for trusted publishing on PyPI
     steps:
       - name: Download wheels
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: wheels
           path: wheels/
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
         with:
           packages-dir: wheels/
           skip-existing: true

hk.pkl

@@ -51,6 +51,7 @@ local python_linters = new Mapping<String, Step> {
 // ---------------------------------------------------------------------------
 local infra_linters = new Mapping<String, Step> {
   ["actionlint"] = Builtins.actionlint
+  ["zizmor"] = Builtins.zizmor
 }
 
 // ---------------------------------------------------------------------------