From a1d4954c4f1b3e72b547777f671358b7edbc1d2f Mon Sep 17 00:00:00 2001
From: Douglas Eichelberger <doug.eichelberger@gusto.com>
Date: Tue, 29 Sep 2026 13:21:16 -0700
Subject: [PATCH] Add zizmor and fix its findings

Adds a zizmor workflow that calls rubyatscale/shared-config's reusable
zizmor.yml, and fixes what zizmor 1.30.1 reports here so it starts
clean.

Actions are pinned to commit SHAs with the exact version in a trailing
comment: checkout at v7.0.1, as shared-config pins it, and the rest at
the release their floating tag runs today. Checkouts set
persist-credentials: false. The @main calls into shared-config, secrets:
inherit and the workflow_run CD trigger get the same documented zizmor
ignores the other rubyatscale repos use. Dependabot entries get a 7-day
cooldown, and a github-actions entry keeps the new pins current.
---
 .github/dependabot.yml       | 12 ++++++++++++
 .github/workflows/cd.yml     |  4 ++--
 .github/workflows/ci.yml     |  8 +++++---
 .github/workflows/stale.yml  |  2 +-
 .github/workflows/triage.yml |  2 +-
 .github/workflows/zizmor.yml | 16 ++++++++++++++++
 6 files changed, 37 insertions(+), 7 deletions(-)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 09f4568..3239b02 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,3 +8,15 @@ updates:
       bundler:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 4c9ab97..57a2a16 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -1,6 +1,6 @@
 name: CD
 
-on:
+on: # zizmor: ignore[dangerous-triggers] deploy-after-CI-passes is the standard rubyatscale release pattern; the called workflow only tags/publishes on main
   workflow_run:
     workflows: [CI]
     types: [completed]
@@ -10,5 +10,5 @@ jobs:
   call-workflow-from-shared-config:
     permissions:
       contents: write
-    uses: rubyatscale/shared-config/.github/workflows/cd.yml@main
+    uses: rubyatscale/shared-config/.github/workflows/cd.yml@main # zizmor: ignore[unpinned-uses,secrets-inherit] internal reusable workflow tracked at @main by convention so shared-config updates propagate automatically; environments are managed by callers
     secrets: inherit
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 76c57c7..0c4f5d7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,15 +11,17 @@ permissions:
 
 jobs:
   call-workflow-from-shared-config:
-    uses: rubyatscale/shared-config/.github/workflows/ci.yml@main
+    uses: rubyatscale/shared-config/.github/workflows/ci.yml@main # zizmor: ignore[unpinned-uses,secrets-inherit] internal reusable workflow tracked at @main by convention so shared-config updates propagate automatically; its ci.yml reads SLACK_WEBHOOK_URL but declares no workflow_call secrets, so inherit is the only way to pass it
     secrets: inherit
   rubyfmt:
     name: "Rubyfmt"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Rubyfmt
-        uses: rubyatscale/rubyfmt-action@v1
+        uses: rubyatscale/rubyfmt-action@cf0cfc65bb8cab4c628ffea8662892598a48d6d3 # v1.0.0
         with:
           paths: |
             lib/
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 2696450..4d49144 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -8,4 +8,4 @@ jobs:
     permissions:
       issues: write
       pull-requests: write
-    uses: rubyatscale/shared-config/.github/workflows/stale.yml@main
+    uses: rubyatscale/shared-config/.github/workflows/stale.yml@main # zizmor: ignore[unpinned-uses] internal reusable workflow tracked at @main by convention so shared-config updates propagate automatically
diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index 7c492ee..7613548 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -8,4 +8,4 @@ jobs:
   call-workflow-from-shared-config:
     permissions:
       issues: write
-    uses: rubyatscale/shared-config/.github/workflows/triage.yml@main
+    uses: rubyatscale/shared-config/.github/workflows/triage.yml@main # zizmor: ignore[unpinned-uses] internal reusable workflow tracked at @main by convention so shared-config updates propagate automatically
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..e5a0721
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,16 @@
+name: GitHub Actions Security Analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    permissions:
+      contents: read
+      security-events: write
+    uses: rubyatscale/shared-config/.github/workflows/zizmor.yml@main # zizmor: ignore[unpinned-uses] internal reusable workflow tracked at @main by convention so shared-config updates propagate automatically