From 5f319f3203db74f22edc55993ad45b912121cce3 Mon Sep 17 00:00:00 2001
From: Ben Challis <ben@lendable.co.uk>
Date: Mon, 17 Aug 2026 21:17:10 +0100
Subject: [PATCH 1/4] chore(ci): add zizmor

---
 .github/workflows/ci.yml      | 26 +++++++++++++++++++++++++-
 .github/workflows/release.yml |  2 ++
 .github/workflows/sloth.yml   |  3 +++
 .github/zizmor.yml            |  5 +++++
 4 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 .github/zizmor.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6c8d0140..d9185d8c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,6 +18,7 @@ jobs:
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           show-progress: false
 
       - name: "Install actionlint"
@@ -25,14 +26,36 @@ jobs:
         run: bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash) 1.7.12
 
       - name: "Run actionlint"
+        env:
+          ACTIONLINT: "${{ steps.actionlint.outputs.executable }}"
         run: |
           echo "::add-matcher::.github/actionlint-matcher.json"
           trap 'echo "::remove-matcher owner=actionlint::"' EXIT
-          "${{ steps.actionlint.outputs.executable }}" -color
+          "$ACTIONLINT" -color
+
+  lint-zizmor:
+    name: "Audit workflows"
+    runs-on: "ubuntu-24.04"
+    permissions:
+      contents: read
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: "Run zizmor"
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          advanced-security: false
+          version: "1.29.0"
 
   ci:
     name: "Execute (PHP ${{ matrix.php-version }} with ${{ matrix.dependencies }} deps, composer v${{ matrix.composer-version}}.x, symfony v${{ matrix.symfony-version }})"
     runs-on: "ubuntu-24.04"
+    permissions:
+      contents: read
 
     strategy:
       matrix:
@@ -57,6 +80,7 @@ jobs:
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           show-progress: false
 
       - name: "Install PHP"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bcfdb195..a1f20cd6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,6 +24,8 @@ jobs:
         with:
           client-id: ${{ secrets.LENDABOT_APP_ID }}
           private-key: ${{ secrets.LENDABOT_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         id: release
diff --git a/.github/workflows/sloth.yml b/.github/workflows/sloth.yml
index 1a114d55..48fb93f4 100644
--- a/.github/workflows/sloth.yml
+++ b/.github/workflows/sloth.yml
@@ -7,6 +7,9 @@ on:
 jobs:
   sloth:
     runs-on: ubuntu-24.04
+    permissions:
+      checks: read
+      contents: read
     steps:
       - name: Sloth
         uses: lendable/sloth@v1
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 00000000..3fc58f20
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "lendable/*": ref-pin

From c23906e13c3e88781797e19b1183c2ceee0bc61f Mon Sep 17 00:00:00 2001
From: Ben Challis <ben@lendable.co.uk>
Date: Mon, 17 Aug 2026 21:20:30 +0100
Subject: [PATCH 2/4] fix(ci): install zizmor from release archive

---
 .github/workflows/ci.yml | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d9185d8c..c5c0df46 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,11 +45,20 @@ jobs:
           persist-credentials: false
           show-progress: false
 
+      - name: "Install zizmor"
+        env:
+          ZIZMOR_SHA256: "dd96df044a6e8538d5f423790f453bdd03d49e5b2bcc38214acc41a2f1297839"
+          ZIZMOR_VERSION: "1.29.0"
+        run: |
+          archive="$RUNNER_TEMP/zizmor.tar.gz"
+          curl --proto '=https' --tlsv1.2 -fsSL "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz" -o "$archive"
+          echo "${ZIZMOR_SHA256}  ${archive}" | sha256sum --check
+          tar -xzf "$archive" -C "$RUNNER_TEMP"
+
       - name: "Run zizmor"
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
-        with:
-          advanced-security: false
-          version: "1.29.0"
+        env:
+          GH_TOKEN: "${{ github.token }}"
+        run: '"$RUNNER_TEMP/zizmor" --format github .'
 
   ci:
     name: "Execute (PHP ${{ matrix.php-version }} with ${{ matrix.dependencies }} deps, composer v${{ matrix.composer-version}}.x, symfony v${{ matrix.symfony-version }})"

From 3f5c374c19381f6a90daaf7c6a16305f00a87618 Mon Sep 17 00:00:00 2001
From: Ben Challis <ben@lendable.co.uk>
Date: Mon, 17 Aug 2026 22:59:33 +0100
Subject: [PATCH 3/4] chore(ci): harden zizmor install shell

---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c5c0df46..42ccd4c1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,10 +46,12 @@ jobs:
           show-progress: false
 
       - name: "Install zizmor"
+        shell: bash
         env:
           ZIZMOR_SHA256: "dd96df044a6e8538d5f423790f453bdd03d49e5b2bcc38214acc41a2f1297839"
           ZIZMOR_VERSION: "1.29.0"
         run: |
+          set -euo pipefail
           archive="$RUNNER_TEMP/zizmor.tar.gz"
           curl --proto '=https' --tlsv1.2 -fsSL "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz" -o "$archive"
           echo "${ZIZMOR_SHA256}  ${archive}" | sha256sum --check

From 5d2a0cd3a4c798d21f3625773a8e5f41a39aacd4 Mon Sep 17 00:00:00 2001
From: Ben Challis <ben@lendable.co.uk>
Date: Tue, 18 Aug 2026 10:53:20 +0100
Subject: [PATCH 4/4] chore(ci): use official zizmor action

---
 .github/workflows/ci.yml | 21 ++++++---------------
 1 file changed, 6 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 42ccd4c1..0fd533aa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,22 +45,13 @@ jobs:
           persist-credentials: false
           show-progress: false
 
-      - name: "Install zizmor"
-        shell: bash
-        env:
-          ZIZMOR_SHA256: "dd96df044a6e8538d5f423790f453bdd03d49e5b2bcc38214acc41a2f1297839"
-          ZIZMOR_VERSION: "1.29.0"
-        run: |
-          set -euo pipefail
-          archive="$RUNNER_TEMP/zizmor.tar.gz"
-          curl --proto '=https' --tlsv1.2 -fsSL "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-x86_64-unknown-linux-gnu.tar.gz" -o "$archive"
-          echo "${ZIZMOR_SHA256}  ${archive}" | sha256sum --check
-          tar -xzf "$archive" -C "$RUNNER_TEMP"
-
       - name: "Run zizmor"
-        env:
-          GH_TOKEN: "${{ github.token }}"
-        run: '"$RUNNER_TEMP/zizmor" --format github .'
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          inputs: "."
+          version: "1.29.0"
+          advanced-security: false
+          annotations: true
 
   ci:
     name: "Execute (PHP ${{ matrix.php-version }} with ${{ matrix.dependencies }} deps, composer v${{ matrix.composer-version}}.x, symfony v${{ matrix.symfony-version }})"