ci: secure workflows with zizmor

Signed-off-by: Eli <88557639+lishaduck@users.noreply.github.com>
Co-authored-by: Eli <elisha.dukes@gmail.com>
Amp-Thread-ID: https://ampcode.com/threads/T-019fbb44-bcba-718f-849a-12815326f2e6

Author: lishaduck

.github/actions/spelling/expect.txt

@@ -8,6 +8,7 @@ apidojo
 apostrophecms
 apps
 arobase
+artipacked
 asi
 audioscrobbler
 Autoloaded
@@ -27,6 +28,7 @@ codelines
 codeql
 colorsets
 Consolas
+cooldown
 datapoints
 dded
 Dexcom
@@ -291,3 +293,4 @@ ytmusic
 Zabcdefghijklmnopqrstuvwxyz
 zenhei
 zenorocha
+zizmor

.github/dependabot.yml

@@ -14,6 +14,8 @@ updates:
       - dependency-name: vue-prism-component
         versions:
           - 2.0.0
+    cooldown:
+      default-days: 7
   - package-ecosystem: github-actions
     labels:
       - 📦 dependencies
@@ -24,3 +26,5 @@ updates:
       - lishaduck
     commit-message:
       prefix: "ci(deps)"
+    cooldown:
+      default-days: 7

.github/scripts/build.mjs

@@ -176,7 +176,7 @@ function testcase(name, env, args) {
 
   if (env === "prod") {
     result.if = "${{ success() || failure() }}"
-    result.uses = "gh-metrics/metrics@master"
+    result.uses = "$/"
     Object.assign(result.with, {output_action: "none", delay: 120})
 
     for (const {property, value} of [{property: "user", value: "gh-metrics"}, {property: "plugins_errors_fatal", value: "yes"}]) {

.github/scripts/files/examples.yml

@@ -32,6 +32,9 @@ on:
         required: true
       WAKATIME_TOKEN:
         required: true
+
+permissions: {}
+
 jobs:
   # ======================================================================================
   # Examples renders
@@ -44,12 +47,15 @@ jobs:
     if: ${{ github.repository == 'gh-metrics/metrics' && false }}
 
     permissions:
-      contents: write
+      contents: write # Push generated examples to the examples branch.
+      packages: read # Pull the private/package-backed metrics action if required.
 
     steps:
+      # zizmor: ignore[artipacked] Credentials are required to publish generated examples.
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
         with:
+          persist-credentials: true
           fetch-depth: 0
           ref: examples
 
@@ -81,18 +87,24 @@ jobs:
     runs-on: ubuntu-latest
     needs: [examples]
 
+    permissions:
+      contents: write # Push repository assets to the examples branch.
+      packages: read # Pull the private/package-backed metrics action if required.
+
     # Skip until I secure the workflows enough to feel comfortable minting tokens.
     if: ${{ github.repository == 'gh-metrics/metrics' && false }}
     steps:
+      # zizmor: ignore[artipacked] Credentials are required to publish generated examples.
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
         with:
+          persist-credentials: true
           fetch-depth: 0
           ref: examples
 
       - name: Contributors
         if: ${{ success() || failure() }}
-        uses: gh-metrics/metrics@master
+        uses: $/
         with:
           filename: metrics.contributors.svg
           token: ${{ secrets.METRICS_TOKEN }}
@@ -108,7 +120,7 @@ jobs:
           delay: 120
       - name: Sponsors
         if: ${{ success() || failure() }}
-        uses: gh-metrics/metrics@master
+        uses: $/
         with:
           filename: metrics.sponsors.svg
           token: ${{ secrets.METRICS_TOKEN_PERSONAL }}
@@ -124,7 +136,7 @@ jobs:
           delay: 120
       - name: Licenses
         if: ${{ success() || failure() }}
-        uses: gh-metrics/metrics@master
+        uses: $/
         with:
           filename: metrics.licenses.svg
           token: ${{ secrets.METRICS_TOKEN }}

.github/workflows/branches.yml

@@ -1,19 +1,26 @@
 name: Check automated branches
 
 on:
+  # zizmor: ignore[dangerous-triggers] This workflow only comments through a pinned action and never executes PR code.
   pull_request_target:
     branches:
       - main
       - latest
       - examples
 
+permissions: {}
+
 jobs:
   notice:
     name: Notice for automated branches
     runs-on: ubuntu-latest
+
+    permissions:
+      pull-requests: write # Explain why automated branches reject the pull request.
+
     steps:
       - name: Comment on pull request
-        uses: actions/github-script@v9
+        uses: actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9.0.0
         with:
           script: |
             const {issue:{number:issue_number}, repo:{owner, repo}} = context
@@ -28,5 +35,5 @@ jobs:
               "",
               "Thanks for your cooperation 🦾!"
             ].join("\n")})
-      - name: Change base branch
+      - name: Fail workflow
         run: exit 1

.github/workflows/ci.yml

@@ -5,35 +5,42 @@ on:
     branches: [ master ]
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
 
   # Build, test and analyze
   build-test-analyze:
     name: Build, test and analyze
     if: ${{ !contains(github.event.head_commit.message, '[skip test]') }}
-    uses: gh-metrics/metrics/.github/workflows/test.yml@master
+    uses: $/.github/workflows/test.yml
+    permissions:
+      contents: read # Check out and test the repository.
 
   # Update plugins and template indexes, along with README.md
   update-indexes:
     name: Publish rebuilt metrics indexes
     runs-on: ubuntu-latest
     needs: [build-test-analyze]
     permissions:
-      contents: write
+      contents: write # Commit and push regenerated indexes.
     steps:
+      # zizmor: ignore[artipacked] Credentials are required to publish regenerated files.
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
         with:
+          persist-credentials: true
           fetch-depth: 0
           ref: master
       - name: Setup NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.0.0
         with:
           node-version: 20
           cache: "npm"
       - name: Setup metrics
         run: npm ci --ignore-scripts --no-audit --no-fund
       - name: Publish rebuild metrics indexes
+        # zizmor: ignore[use-trusted-publishing] This publishes generated files to Git, not an npm package.
         run: npm run build -- publish
 
   # Rebase main branch on master
@@ -42,11 +49,12 @@ jobs:
     runs-on: ubuntu-latest
     needs: [update-indexes]
     permissions:
-      contents: write
+      contents: write # Merge master into and push the main branch.
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
         with:
+          persist-credentials: true
           fetch-depth: 0
           ref: main
       - name: Configure Git Identity
@@ -64,12 +72,18 @@ jobs:
     runs-on: ubuntu-latest
     needs: [update-indexes]
     permissions:
-      packages: write
+      contents: read # Build the image from repository contents.
+      packages: write # Publish master and beta container images.
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Login to GitHub registry
-        run: echo ${{ github.token }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
       - name: Build docker image
         run: docker build -t ghcr.io/gh-metrics/metrics:master .
       - name: Publish to GitHub registry
@@ -98,7 +112,9 @@ jobs:
     if: github.repository_owner == 'lowlighter'
     steps:
       - name: Deploy web instance
-        run: "curl -X POST -H 'Authorization: ${{ secrets.WEB_DEPLOY_BETA_TOKEN }}' https://beta-metrics.lecoq.io/.control/stop"
+        env:
+          WEB_DEPLOY_TOKEN: ${{ secrets.WEB_DEPLOY_BETA_TOKEN }}
+        run: "curl -X POST -H 'Authorization: $WEB_DEPLOY_TOKEN' https://beta-metrics.lecoq.io/.control/stop"
       - name: Wait for redeploy
         run: sleep 120
       - name: Check deployment status
@@ -111,7 +127,7 @@ jobs:
     needs: [docker-master]
     steps:
       - name: Run tests
-        uses: gh-metrics/metrics@master
+        uses: $/
         with:
           token: MOCKED_TOKEN
           plugins_errors_fatal: yes
@@ -123,10 +139,10 @@ jobs:
   publish-examples:
     name: Publish examples
     needs: [action-master-test]
-    uses: gh-metrics/metrics/.github/workflows/examples.yml@master
+    uses: $/.github/workflows/examples.yml
     permissions:
-      contents: write
-      packages: read
+      contents: write # Publish generated examples.
+      packages: read # Pull the metrics action image.
     secrets:
       METRICS_TOKEN: ${{ secrets.METRICS_TOKEN }}
       METRICS_TOKEN_WITH_SCOPES: ${{ secrets.METRICS_TOKEN_WITH_SCOPES }}
@@ -146,21 +162,29 @@ jobs:
   publish-examples-presets:
     name: Publish examples (presets)
     needs: [action-master-test]
-    uses: gh-metrics/metrics/.github/workflows/examples.presets.yml@master
+    uses: $/.github/workflows/examples.presets.yml
     permissions:
-      contents: write
+      contents: write # Publish generated preset examples.
 
   # Build docker image from master and publish it to GitHub registry with release tag
   docker-release:
     name: Publish release to GitHub registry
     runs-on: ubuntu-latest
     needs: [publish-examples]
     if: contains(github.event.head_commit.message, '[release]')
+    permissions:
+      contents: read # Read release metadata from the repository.
+      packages: write # Publish release and latest container images.
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Login to GitHub registry
-        run: echo ${{ github.token }} | docker login ghcr.io -u ${{ github.actor }} --password-stdin
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_TOKEN: ${{ github.token }}
+        run: echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
       - name: Pull docker image (master)
         run: docker pull ghcr.io/gh-metrics/metrics:master
       - name: Tag docker image (release)
@@ -181,10 +205,13 @@ jobs:
     name: Rebase latest on master
     runs-on: ubuntu-latest
     needs: [docker-release]
+    permissions:
+      contents: write # Merge master into and push the latest branch.
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
         with:
+          persist-credentials: true
           fetch-depth: 0
           ref: latest
       - name: Configure Git Identity
@@ -201,9 +228,11 @@ jobs:
     name: Test gh-metrics/metrics@latest
     runs-on: ubuntu-latest
     needs: [update-latest]
+    permissions:
+      packages: read # Pull the metrics action image.
     steps:
       - name: Run tests
-        uses: gh-metrics/metrics@latest
+        uses: gh-metrics/metrics@latest # zizmor: ignore[unpinned-uses] First-party action must test latest.
         with:
           token: MOCKED_TOKEN
           plugins_errors_fatal: yes
@@ -219,7 +248,9 @@ jobs:
     if: github.repository_owner == 'lowlighter'
     steps:
       - name: Deploy web instance
-        run: "curl -X POST -H 'Authorization: ${{ secrets.WEB_DEPLOY_TOKEN }}' https://metrics.lecoq.io/.control/stop"
+        env:
+          WEB_DEPLOY_TOKEN: ${{ secrets.WEB_DEPLOY_TOKEN }}
+        run: "curl -X POST -H 'Authorization: $WEB_DEPLOY_TOKEN' https://metrics.lecoq.io/.control/stop"
       - name: Wait for redeploy
         run: sleep 120
       - name: Check deployment status
@@ -230,11 +261,16 @@ jobs:
     name: Publish release
     runs-on: ubuntu-latest
     needs: [action-latest-test, deploy-latest]
+    permissions:
+      contents: write # Create the GitHub release.
     steps:
+      # zizmor: ignore[artipacked] Credentials are required to replace an existing release tag.
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
+        with:
+          persist-credentials: true
       - name: Setup NodeJS
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.0.0
         with:
           node-version: 20
           cache: "npm"

.github/workflows/clean.yml

@@ -6,14 +6,23 @@ on:
       - published
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   clean:
     name: Clean untagged docker images
     runs-on: ubuntu-latest
     continue-on-error: true
+
+    permissions:
+      contents: read # Check out the cleanup script.
+      packages: write # Delete untagged container images.
+
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.0
+        with:
+          persist-credentials: false
       - name: Run script
         run: ./delete_ghcr_dangling_images.sh gh-metrics metrics
         working-directory: .github/actions/ghcr-clean