fix(ci): resolve all zizmor findings in GitHub workflows
Metadata
Current evaluation
Merged. Resolved all 44 zizmor findings in GitHub Actions by pinning actions to commit hashes, restricting permissions, removing secrets inheritance, replacing a release action with a script, and adding justified ignores. All CI checks passed.
Suggested action: —
No scores available.
Issue body
> 🤖 This PR description was generated by an AI agent (GitHub Copilot CLI).
## Summary
Fixes every finding reported by [zizmor](https://docs.zizmor.sh) across all GitHub Actions workflows (44 findings → 0).
## Changes
- Pin all third-party actions to commit hashes (`unpinned-uses`), except `canonical/starflow/...@main` references, which are intentionally kept at `@main` per team policy and suppressed with a documented `zizmor: ignore` comment.
- Add `persist-credentials: false` to all `actions/checkout` steps (`artipacked`).
- Scope down permissions (`excessive-permissions`): replace workflow-level `contents: write` in `release-publish.yaml` with per-job permissions, and add explicit `permissions:` blocks where missing.
- Replace `secrets: inherit` in `tics.yaml` with an explicit pass-through of just the one secret needed (`secrets-inherit`).
- Replace `softprops/action-gh-release` with a `gh release create` script step (`superfluous-actions`), passing the tag via an env var to avoid `template-injection`.
- Add a documented, justified ignore for the ad-hoc renovate npm install (`adhoc-packages`) since it has no meaningful lockfile.
## Testing
- `zizmor .` → 0 findings
- `make lint-actions` / `make lint-prettier` → pass
- All CI checks pass, including the repo's own zizmor audit job
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b | — | — | Merged. Resolved all 44 zizmor findings in GitHub Actions by pinning actions to commit hashes, restricting permissions, removing secrets inheritance, replacing a release action with a script, and adding justified ignores. All CI checks passed. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
0
Complexity:
15
Confidence:
95
|
needs review | Resolves 44 zizmor security findings across GitHub Actions workflows by pinning actions, scoping permissions, and replacing insecure patterns. All CI checks pass and the PR has two approvals. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
95
|
needs review | Resolves 44 zizmor security findings across GitHub Actions workflows by pinning actions, scoping permissions, and replacing unsafe patterns. All CI checks pass and the PR has one approval. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
0
Complexity:
15
Confidence:
95
|
needs review | Resolves all zizmor security findings in GitHub workflows by pinning actions, scoping permissions, and replacing unsafe patterns. All CI checks pass; awaiting maintainer review. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
0
Complexity:
15
Confidence:
90
|
needs review | Resolves 44 zizmor security findings across GitHub Actions workflows by pinning actions, scoping permissions, and removing redundant actions. All CI checks pass, awaiting maintainer review. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Resolves 44 zizmor security findings in GitHub Actions workflows by pinning actions, scoping permissions, and replacing unsafe patterns. All CI checks pass, awaiting maintainer review. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Resolves 44 zizmor security findings across GitHub Actions workflows by pinning actions, scoping permissions, and replacing third-party actions. All CI checks pass. Awaiting maintainer review. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Resolves all zizmor security findings in GitHub workflows by pinning actions, scoping permissions, replacing third-party release actions, and documenting ignores. All CI checks pass, awaiting maintainer review. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
|
needs review | Resolves all zizmor security findings in GitHub Actions workflows by pinning actions, scoping permissions, removing secrets inheritance, and replacing third-party release actions. Currently passing CI and awaiting maintainer review. |
Update history
| Date | Change |
|---|---|
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| updated | |
| created |
Related issues
No related issues found above the similarity threshold.