ci: add zizmor scanning and fix workflow issues

.github/dependabot.yml

@@ -7,7 +7,7 @@ updates:
     schedule:
       interval: weekly
     cooldown:
-      default-days: 3
+      default-days: 7
     commit-message:
       prefix: 'chore'
       include: 'scope'
@@ -26,7 +26,7 @@ updates:
     schedule:
       interval: weekly
     cooldown:
-      default-days: 3
+      default-days: 7
     commit-message:
       prefix: 'chore'
       include: 'scope'
@@ -52,6 +52,7 @@ updates:
       semver-patch-days: 3
       semver-minor-days: 3
       semver-major-days: 7
+      default-days: 7
     open-pull-requests-limit: 10
     commit-message:
       prefix: 'chore'

.github/workflows/ci.yml

@@ -10,7 +10,7 @@ on:
     branches: [main]
 
 permissions:
-  pull-requests: write
+  contents: read
 
 jobs:
   build-ubuntu:
@@ -31,6 +31,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Use Node.js ${{ matrix.node-version }}
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -103,6 +104,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Use Node.js 24.x
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0

.github/workflows/codeql.yml

@@ -31,17 +31,20 @@ jobs:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@d97b3428e8eebbb1810cf454d6397886d136b4ba # ratchet:github/codeql-action/init@v4
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@d97b3428e8eebbb1810cf454d6397886d136b4ba # ratchet:github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@d97b3428e8eebbb1810cf454d6397886d136b4ba # ratchet:github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
         with:
           category: '/language:${{matrix.language}}'

.github/workflows/dependency-review.yml

@@ -16,8 +16,10 @@ jobs:
 
       - name: 'Checkout Repository'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Dependency Review
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
           comment-summary-in-pr: always
           fail-on-severity: high

.github/workflows/docker-publish.yml

@@ -27,7 +27,8 @@ jobs:
 
       - name: Checkout Repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-
+        with:
+          persist-credentials: false
       - name: Log in to Docker Hub
         if: github.repository_owner == 'finos'
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
@@ -39,7 +40,7 @@ jobs:
         id: tags
         run: |
           if [ "${{ github.event_name }}" = "release" ]; then
-            echo "tags=${{ github.repository }}:${{ github.ref_name }},${{ github.repository }}:latest" >> $GITHUB_OUTPUT
+            echo "tags=${{ github.repository }}:${GITHUB_REF_NAME},${{ github.repository }}:latest" >> $GITHUB_OUTPUT
           else
             echo "tags=${{ github.repository }}:main" >> $GITHUB_OUTPUT
           fi

.github/workflows/e2e.yml

@@ -2,8 +2,6 @@ name: E2E Tests
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 on:
   push:
@@ -28,6 +26,8 @@ jobs:
 
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c
@@ -41,7 +41,7 @@ jobs:
         uses: docker/setup-compose-action@3408803818f5b5065308cdf3293ecbddf1ab2fac
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           cache: 'npm'

.github/workflows/experimental-inventory-ci.yml

@@ -31,9 +31,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
 

.github/workflows/experimental-inventory-cli-publish.yml

@@ -19,17 +19,21 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
 
       - name: check version matches input
         run: |
-          grep "\"version\": \"${{ github.event.inputs.version }}\"," package.json
+          grep "\"version\": \"${GITHUB_EVENT_INPUTS_VERSION}\"," package.json
         working-directory: ./experimental/li-cli
+        env:
+          GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }}
 
       - run: npm ci
         working-directory: ./experimental/li-cli
@@ -41,3 +45,5 @@ jobs:
         working-directory: ./experimental/li-cli
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+        with:
+          persist-credentials: false

.github/workflows/experimental-inventory-publish.yml

@@ -19,17 +19,22 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'
+          persist-credentials: false
 
       - name: check version matches input
         run: |
-          grep "\"version\": \"${{ github.event.inputs.version }}\"," package.json
+          grep "\"version\": \"${GITHUB_EVENT_INPUTS_VERSION}\"," package.json
         working-directory: ./experimental/license-inventory
+        env:
+          GITHUB_EVENT_INPUTS_VERSION: ${{ github.event.inputs.version }}
 
       - run: npm ci
         working-directory: ./experimental/license-inventory

.github/workflows/lint.yml

@@ -19,14 +19,15 @@ jobs:
           egress-policy: audit
 
       - name: Install NodeJS
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
       - name: Code Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Install Dependencies
         run: npm ci

.github/workflows/npm.yml

@@ -1,6 +1,8 @@
 name: Publish to NPM
 on:
   release:
+    # False positive: setup-node step doesn't use cache input
+    # zizmor: ignore[cache-poisoning]
     types: [published]
   workflow_dispatch:
     inputs:
@@ -26,8 +28,10 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/pr-lint.yml

@@ -3,6 +3,8 @@
 name: 'PR'
 
 on:
+  # PR target used in accordance with README
+  # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types:
       - opened

.github/workflows/sample-publish.yml

@@ -3,6 +3,8 @@ name: Publish samples to NPM
 on:
   push:
     tags:
+      # False positive: setup-node step doesn't use cache input
+      # zizmor: ignore[cache-poisoning]
       - 'sample-*'
 
 permissions:
@@ -17,8 +19,11 @@ jobs:
         with:
           egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24.x'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/unused-dependencies.yml

@@ -15,8 +15,11 @@ jobs:
 
       - name: 'Checkout Repository'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: 'Setup Node.js'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '24.x'
       - name: 'Run depcheck'

.github/workflows/zizmor.yml

@@ -0,0 +1,32 @@
+name: zizmor
+
+# Static analysis of GitHub Actions workflows with zizmor
+# (https://docs.zizmor.sh). Results are uploaded as SARIF to
+# Code Scanning; findings do not fail the build.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write # SARIF upload to Code Scanning
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        with:
+          min-severity: low
+          min-confidence: low