From 5d91ece57a96c122733500e2f3bb0e1a5e9ea9b0 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 16:35:03 -0400 Subject: [PATCH 1/4] Add zizmor and actionlint CI job for GitHub Actions auditing Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/ci.yml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7f7241a..6b84368 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,6 +1,23 @@ name: CI on: [push, pull_request] jobs: + lint-actions: + name: GitHub Actions audit + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v6 + with: + persist-credentials: false + + - name: Run actionlint + uses: rhysd/actionlint@v1.7.11 + + - name: Run zizmor + uses: zizmorcore/zizmor-action@v0.5.2 + with: + advanced-security: false + tests: runs-on: ubuntu-latest From aa7f156b130b3d58e8b48e983f31c806b7f5741b Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 16:35:19 -0400 Subject: [PATCH 2/4] Configure dependabot for github-actions and bundler with batching and cooldowns Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/dependabot.yml | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..60ab37f --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,23 @@ +version: 2 + +updates: + - package-ecosystem: github-actions + directory: "/" + groups: + github-actions: + patterns: + - "*" + schedule: + interval: weekly + cooldown: + default-days: 7 + + - package-ecosystem: bundler + directory: "/" + schedule: + interval: weekly + cooldown: + semver-major-days: 7 + semver-minor-days: 3 + semver-patch-days: 2 + default-days: 7 From 0c9dee2adc13b71f5dbfd6b1adb723bd42d35b42 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 16:35:37 -0400 Subject: [PATCH 3/4] Pin all GitHub Actions to SHA hashes Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/ci.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 6b84368..3bd17f6 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -6,15 +6,15 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 with: persist-credentials: false - name: Run actionlint - uses: rhysd/actionlint@v1.7.11 + uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11 - name: Run zizmor - uses: zizmorcore/zizmor-action@v0.5.2 + uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2 with: advanced-security: false @@ -22,10 +22,10 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Ruby - uses: ruby/setup-ruby@v1 + uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0 with: ruby-version: 3.2 bundler-cache: true From 8d5b31dba454167eb5f9cfc1da51ce42511f0011 Mon Sep 17 00:00:00 2001 From: Mike Dalessio Date: Fri, 20 Mar 2026 16:36:38 -0400 Subject: [PATCH 4/4] Fix excessive-permissions and artipacked findings Set permissions: {} at workflow level with scoped contents: read per job. Add persist-credentials: false to tests checkout. Co-Authored-By: Claude Opus 4.6 (1M context) --- .github/workflows/ci.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3bd17f6..6c23e47 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1,9 +1,12 @@ name: CI on: [push, pull_request] +permissions: {} jobs: lint-actions: name: GitHub Actions audit runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 @@ -20,9 +23,13 @@ jobs: tests: runs-on: ubuntu-latest + permissions: + contents: read steps: - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 + with: + persist-credentials: false - name: Set up Ruby uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0