Add zizmor workflow and harden github actions (#411)

* Add zizmor workflow

* Add cooldown for dependabot

* Increase to weekly updates for dependabot

* Security hardening of ci.yml

Author: PrinsFrank

.github/dependabot.yml

@@ -7,9 +7,14 @@ updates:
     package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-        interval: "monthly"
+        interval: "weekly"
+    cooldown:
+      default-days: 7
+
 -
     package-ecosystem: "composer"
     directory: "/"
     schedule:
-        interval: "monthly"
+        interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -10,54 +10,71 @@ on:
   schedule:
     - cron: '55 17 * * *'
 
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}-main
+  cancel-in-progress: true
+
 jobs:
   quality:
-    uses: prinsfrank/CI-PHP/.github/workflows/quality.yml@main
+    permissions:
+      contents: read
+    uses: prinsfrank/CI-PHP/.github/workflows/quality.yml@7f532694f9ad3b0da45333d0c140b340488ac9b1 # v1.2.0
     with:
       PHP_VERSION: '8.3'
       PHP_VERSIONS: '["8.2", "8.3", "8.4", "8.5"]'
-    secrets: inherit
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
 
   feature:
     name: PHP Tests - Feature
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         php-version: ["8.2", "8.3", "8.4", "8.5"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php-version }}
           coverage: none
 
       - name: Install dependencies
-        uses: ramsey/composer-install@v4
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
 
       - name: Run Feature tests
         run: composer run feature
 
   samples:
     name: PHP Tests - Samples
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         php-version: ["8.2", "8.3", "8.4", "8.5"]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php-version }}
           coverage: none
 
       - name: Install dependencies
-        uses: ramsey/composer-install@v4
+        uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
 
       - name: Run Samples tests
         run: vendor/bin/phpunit tests/Samples/

.github/workflows/zizmor.yml

@@ -0,0 +1,35 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/**.yml'
+  pull_request:
+    paths:
+      - '.github/**.yml'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          advanced-security: false
+          annotations: true
+          persona: 'pedantic'