ci: scan for secrets and audit workflows

.github/dependabot.yml

@@ -4,6 +4,8 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 1
     groups:
       gradle-patch-minor:
         update-types: ["patch", "minor"]

.github/workflows/ci.yml

@@ -63,13 +63,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           validate-wrappers: true
 
@@ -94,13 +94,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           validate-wrappers: true
 
@@ -132,13 +132,13 @@ jobs:
           printf '%s\n' "$app_parents" | tee -a "$GITHUB_STEP_SUMMARY"
 
       - name: Set up Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           validate-wrappers: true
 

.github/workflows/emulator-smoke.yml

@@ -59,13 +59,13 @@ jobs:
           printf '%s\n' "$app_parents" | tee -a "$GITHUB_STEP_SUMMARY"
 
       - name: Set up Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           validate-wrappers: true
 

.github/workflows/scan.yml

@@ -0,0 +1,19 @@
+name: Scan
+
+on:
+  pull_request:
+  schedule:
+    - cron: "41 6 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    permissions:
+      contents: read
+    uses: putdotio/.github/.github/workflows/frontend-scan.yml@1ee0d3b473cbc6fada08831f01ff80fe653c434a # v1.1.0

.github/zizmor.yml

@@ -0,0 +1,8 @@
+rules:
+  dependabot-cooldown:
+    config:
+      days: 1
+  unpinned-uses:
+    config:
+      policies:
+        "*": hash-pin

AGENTS.md

@@ -160,6 +160,10 @@ and `StaleOAuthCallbackTest` on a Gradle Managed Device weekly and on dispatch.
 It is not a pull-request gate because shared-runner emulator boots are too slow
 and flaky; `scripts/prove.sh` stays the local proof.
 
+[Scan](.github/workflows/scan.yml) runs the shared put.io scan weekly and on
+every pull request: Gitleaks and TruffleHog look for secrets, and Actionlint
+and Zizmor audit `.github/` when a pull request changes it.
+
 To reproduce a CI failure, check out the app SHA from the run summary in a
 detached worktree with `sdk.dir` set and `putioSdkKotlinPath` unset, then run
 the same command. A pull-request run tests a temporary merge commit; if it is