MAINT: Add Zizmor

.github/dependabot.yaml

@@ -7,12 +7,16 @@ updates:
     directory: '/'
     schedule:
       interval: 'monthly'
+    cooldown:
+      default-days: 7
 
   # Maintain dependencies for npm
   - package-ecosystem: 'npm'
     directory: '/'
     schedule:
       interval: 'monthly'
+    cooldown:
+      default-days: 7
 
     groups:
       dependencies:

.github/workflows/deploy.yml

@@ -7,11 +7,7 @@ on:
     branches: [main]
   workflow_dispatch:
 
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+permissions: {}
 
 # Allow only one concurrent deployment
 concurrency:
@@ -21,19 +17,22 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # Required to check out the repository.
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true
+          persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '20'
           cache: 'npm'
       - name: Restore cache
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             .next/cache
@@ -49,7 +48,7 @@ jobs:
         run: npm run build
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: ./out
 
@@ -59,8 +58,11 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      pages: write # Required by actions/deploy-pages to deploy to GitHub Pages.
+      id-token: write # Required by actions/deploy-pages to verify the deployment originates from an appropriate source (OIDC).
     if: github.ref == 'refs/heads/main'
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/linkcheck.yml

@@ -8,21 +8,25 @@ on:
 env:
   LINK_TRACKING_ISSUE_NUMBER: 85
 
-permissions:
-  issues: write
+permissions: {}
 
 jobs:
   check-urls:
     if: ${{ !github.event.repository.fork }}
     env:
       LYCHEE_REPORT_FILE: ./lychee/out.md
     runs-on: ubuntu-latest
+    permissions:
+      contents: read # Required to check out the repository.
+      issues: write # Required to update the link tracking issue.
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@v2.9.0
+        uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0
         with:
           # v2 fails the job on broken links by default; keep the old behaviour
           # so the tracking issue below gets updated instead.
@@ -33,17 +37,19 @@ jobs:
         id: readReport
         run: |
           EOF=$(dd if=/dev/urandom bs=15 count=1 status=none | base64)
-          echo "FILE_CONTENT<<$EOF" >> $GITHUB_OUTPUT
-          echo "$(cat ${{ env.LYCHEE_REPORT_FILE }})" >> $GITHUB_OUTPUT
-          echo "$EOF" >> $GITHUB_OUTPUT
-      - run: echo "${{ steps.readReport.outputs.FILE_CONTENT }}"
+          echo "FILE_CONTENT<<$EOF" >> "$GITHUB_OUTPUT"
+          echo "$(cat "${LYCHEE_REPORT_FILE}")" >> "$GITHUB_OUTPUT"
+          echo "$EOF" >> "$GITHUB_OUTPUT"
+      - env:
+          FILE_CONTENT: ${{ steps.readReport.outputs.FILE_CONTENT }}
+        run: echo "${FILE_CONTENT}"
       - name: Update link tracking issue (update invalid links)
         if: steps.lychee.outputs.exit_code != 0
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ISSUE_BODY: ${{ steps.readReport.outputs.FILE_CONTENT }}
         run: |
-          gh api --method PATCH "repos/${{ github.repository }}/issues/${LINK_TRACKING_ISSUE_NUMBER}" \
+          gh api --method PATCH "repos/${GITHUB_REPOSITORY}/issues/${LINK_TRACKING_ISSUE_NUMBER}" \
             -f state=open \
             -f body="${ISSUE_BODY}"
 
@@ -52,12 +58,12 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh api --method PATCH "repos/${{ github.repository }}/issues/${LINK_TRACKING_ISSUE_NUMBER}" \
+          gh api --method PATCH "repos/${GITHUB_REPOSITORY}/issues/${LINK_TRACKING_ISSUE_NUMBER}" \
             -f state=closed \
             -f body='No invalid links found! 🤖'
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: lychee-report
           path: ${{ env.LYCHEE_REPORT_FILE }}

.github/workflows/zizmor.yml

@@ -0,0 +1,24 @@
+name: GHA Security Analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: GHA Security Analysis using Zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # Required to check out the repository.
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0

.pre-commit-config.yaml

@@ -13,8 +13,14 @@ repos:
       - id: double-quote-string-fixer
         exclude: \.html$
 
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: 'v4.0.0-alpha.8'
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.31.1
+    hooks:
+      - id: zizmor
+        args: ['--offline']
+
+  - repo: https://github.com/rbubley/mirrors-prettier # Update mirror as official mirror is deprecated
+    rev: v3.9.10
     hooks:
       - id: prettier
         exclude: \.html$
@@ -29,8 +35,8 @@ repos:
           |vue\
           |yaml|yml\
           )$"
-  - repo: https://github.com/pre-commit/mirrors-prettier
-    rev: 'v4.0.0-alpha.8'
+  - repo: https://github.com/rbubley/mirrors-prettier # Update mirror as official mirror is deprecated
+    rev: v3.9.10
     hooks:
       - id: prettier