Remediate release-tools workflow security findings (zizmor)

.automaker-lock

@@ -0,0 +1,5 @@
+{
+  "pid": 7,
+  "featureId": "feature-1780624367032-75rysm15r",
+  "startedAt": "2026-06-05T07:18:38.748Z"
+}

.github/workflows/ci.yml

@@ -15,11 +15,12 @@ jobs:
     runs-on: namespace-profile-protolabs-linux
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
           cache: npm

.github/workflows/release.yml

@@ -25,12 +25,13 @@ jobs:
        startsWith(github.event.head_commit.message, 'chore: release v'))
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
+          persist-credentials: false
           token: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org/"
@@ -80,12 +81,14 @@ jobs:
 
       - name: Tag
         if: steps.version.outputs.tag_exists != 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GH_PAT || secrets.GITHUB_TOKEN }}
         run: |
           git config --local user.email "github-actions[bot]@users.noreply.github.com"
           git config --local user.name  "github-actions[bot]"
           git tag -a "${{ steps.version.outputs.tag }}" \
             -m "Release ${{ steps.version.outputs.tag }}"
-          git push origin "${{ steps.version.outputs.tag }}"
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "${{ steps.version.outputs.tag }}"
 
       - name: Publish to npm
         # Auth via org automation token. The package's publishing access allows

.github/workflows/tauri-release.yml

@@ -90,20 +90,22 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
       - name: Setup pnpm
         if: inputs.pnpm-version != ''
-        uses: pnpm/action-setup@v6
+        uses: pnpm/action-setup@ac6db6d3c1f721f886538a378a2d73e85697340a # v6
         with:
           version: ${{ inputs.pnpm-version }}
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ${{ inputs.node-version }}
           cache: ${{ inputs.pnpm-version != '' && 'pnpm' || 'npm' }}
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
       - name: Add macOS Rust targets (universal)
         if: matrix.platform == 'macos'
@@ -131,7 +133,9 @@ jobs:
 
       - name: Pre-build command
         if: inputs.pre-build-command != ''
-        run: ${{ inputs.pre-build-command }}
+        env:
+          PRE_BUILD_CMD: ${{ inputs.pre-build-command }}
+        run: bash -c "$PRE_BUILD_CMD"
         shell: bash
 
       # ─── macOS: write the App Store Connect API key to disk ──────────────
@@ -154,7 +158,7 @@ jobs:
       # ─── macOS: sign + notarize + updater-sign ────────────────────────────
       - name: Build (macOS, signed + notarized)
         if: matrix.platform == 'macos'
-        uses: tauri-apps/tauri-action@v0
+        uses: tauri-apps/tauri-action@fce9c6108b31ea247710505d3aaaa893ee6768d4 # v0
         env:
           # Code signing
           APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
@@ -180,7 +184,7 @@ jobs:
       # ─── Windows: SSL.com eSigner + updater-sign ──────────────────────────
       - name: Build (Windows, signed via eSigner)
         if: matrix.platform == 'windows'
-        uses: tauri-apps/tauri-action@v0
+        uses: tauri-apps/tauri-action@fce9c6108b31ea247710505d3aaaa893ee6768d4 # v0
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
@@ -194,15 +198,15 @@ jobs:
       # ─── Linux: AppImage, no signing ──────────────────────────────────────
       - name: Build (Linux, AppImage)
         if: matrix.platform == 'linux'
-        uses: tauri-apps/tauri-action@v0
+        uses: tauri-apps/tauri-action@fce9c6108b31ea247710505d3aaaa893ee6768d4 # v0
         env:
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
           TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
         with:
           projectPath: ${{ inputs.project-path }}
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: tauri-${{ matrix.platform }}
           path: |
@@ -228,14 +232,16 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
 
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           path: dist
           merge-multiple: true
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ${{ inputs.node-version }}
 
@@ -253,7 +259,7 @@ jobs:
             --out latest.json
 
       - name: Upload binaries to R2 (versioned prefix)
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.R2_ACCOUNT_ID }}
@@ -267,7 +273,7 @@ jobs:
             done
 
       - name: Upload updater manifest to R2 (latest.json, no-cache)
-        uses: cloudflare/wrangler-action@v3
+        uses: cloudflare/wrangler-action@9acf94ace14e7dc412b076f2c5c20b8ce93c79cd # v3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.R2_ACCOUNT_ID }}
@@ -281,7 +287,7 @@ jobs:
 
       - name: Create draft GitHub Release
         if: inputs.draft-github-release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3
         with:
           files: dist/**/*
           draft: true