ci: audit workflows with zizmor and fix its findings

.github/workflows/ci.yml

@@ -9,11 +9,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - uses: voidzero-dev/setup-vp@1b32467adbe183473499fd9d5d372c3ed9641754 # v1.18.0
         with:
@@ -34,14 +39,21 @@ jobs:
 
       - run: vp run ts-compatibility
 
-  actionlint:
+  workflows:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       # The versions pinned in mise.toml, so CI lints with the ones the hook runs.
       - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
         with:
-          install_args: actionlint shellcheck
+          install_args: actionlint shellcheck zizmor
 
       - run: actionlint
+
+      # The token enables the audits that query GitHub, such as known-vulnerable actions.
+      - run: zizmor .github/workflows
+        env:
+          GH_TOKEN: ${{ github.token }}

.github/workflows/docs.yml

@@ -26,12 +26,17 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   # The same build the release runs, so a broken book fails the PR and not the tag.
   build:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - uses: voidzero-dev/setup-vp@1b32467adbe183473499fd9d5d372c3ed9641754 # v1.18.0
         with:

.github/workflows/release.yml

@@ -4,6 +4,8 @@ on:
   push:
     tags: ["v*"]
 
+permissions: {}
+
 jobs:
   release:
     runs-on: ubuntu-latest
@@ -14,11 +16,12 @@ jobs:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           fetch-depth: 0 # needed to check the tag is an ancestor of main
+          persist-credentials: false
 
+      # No cache in this workflow: a cache another ref wrote must not reach what a tag publishes.
       - uses: voidzero-dev/setup-vp@1b32467adbe183473499fd9d5d372c3ed9641754 # v1.18.0
         with:
           node-version: "24"
-          cache: true
           registry-url: "https://registry.npmjs.org"
 
       # setup-vp puts `vp` on PATH but not pnpm, which the publish step needs.
@@ -72,14 +75,17 @@ jobs:
       group: gh-pages # two releases must not push the site at once
     steps:
       - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - uses: voidzero-dev/setup-vp@1b32467adbe183473499fd9d5d372c3ed9641754 # v1.18.0
         with:
           node-version: "24"
-          cache: true
 
       # mdbook and mdbook-linkcheck2, pinned in mise.toml.
       - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
+        with:
+          cache: false
 
       - run: vp install
 
@@ -106,10 +112,14 @@ jobs:
           node docs/tools/version-index/index.ts site
           touch site/.nojekyll
 
+      # The checkout keeps no credentials, so the token reaches this step alone and not the
+      # dependencies `vp install` runs.
       - name: Push the site
         run: |
           git -C site add --all
           git -C site -c user.name="github-actions[bot]" \
             -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
             commit --message "docs: publish $GITHUB_REF_NAME"
-          git -C site push origin HEAD:gh-pages
+          git -C site push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" HEAD:gh-pages
+        env:
+          GH_TOKEN: ${{ github.token }}

mise.toml

@@ -8,6 +8,7 @@ pinact = "5.0.0"
 actionlint = "1.7.12"
 # actionlint runs it over each `run:` script.
 shellcheck = "0.11.0"
+zizmor = "1.30.1"
 
 [settings]
 lockfile = true

vite.config.ts

@@ -5,7 +5,7 @@ import lint from "./oxlint.config.ts";
 export default defineConfig({
   staged: {
     "*": "vp check --fix",
-    ".github/workflows/*.yml": "actionlint",
+    ".github/workflows/*.yml": ["actionlint", "zizmor --offline"],
   },
   pack: {
     // Named, so the import path is the name a user writes rather than where the file sits.