Merge pull request #453 from opf/chore/zizmor

Add zizmor scan

Author: myabc

.github/actions/upload-versions/action.yml

@@ -16,11 +16,13 @@ runs:
         node-version: 24
     - name: Write workspace versions as JSON file
       uses: actions/github-script@a3e7071a34d7e1f219a8a4de9a5e0a34d1ee1293
+      env:
+        PACKAGE_PATHS: ${{ inputs.package_paths }}
       with:
         script: |
           const fs = require('node:fs');
 
-          const globber = await glob.create(`${{ inputs.package_paths }}`)
+          const globber = await glob.create(process.env.PACKAGE_PATHS)
           const packageJsonPaths = await globber.glob()
           const output = {
             packages: [],

.github/dependabot.yml

@@ -17,6 +17,8 @@ updates:
       all-actions:
         update-types:
         - "patch"
+    cooldown:
+      default-days: 7
 
   # NPM
   - package-ecosystem: "npm"
@@ -36,6 +38,8 @@ updates:
         dependency-type: "development"
         update-types:
         - "patch"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "npm"
     directory: "/demo"
@@ -49,6 +53,8 @@ updates:
       all-demo:
         update-types:
         - "patch"
+    cooldown:
+      default-days: 7
 
 
   # Bundler
@@ -69,6 +75,8 @@ updates:
         dependency-type: "development"
         update-types:
         - "patch"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "bundler"
     directory: "/demo"
     schedule:
@@ -80,4 +88,6 @@ updates:
     groups:
       all-demo:
         update-types:
-        - "patch"
+        - "patch"
+    cooldown:
+      default-days: 7

.github/workflows/accessibility-alt-text-bot.yml

@@ -23,4 +23,4 @@ jobs:
     if: ${{ github.event.issue || github.event.pull_request || github.event.discussion }}
     steps:
       - name: Get action 'github/accessibility-alt-text-bot'
-        uses: github/accessibility-alt-text-bot@v1.7.3
+        uses: github/accessibility-alt-text-bot@7e895d46677f15841def9acef1239ea7c12593a5 # v1.7.3

.github/workflows/codeql-analysis.yml

@@ -6,27 +6,34 @@ on:
   schedule:
     - cron: '37 7 * * 1'
 
+permissions: {}
+
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
       with:
         languages: javascript
 
-    - uses: actions/setup-node@v5
+    - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
       with:
         node-version: 20
         cache: 'npm'
     - run: |
         npm ci
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4

.github/workflows/demo-preview-cleanup.yml

@@ -23,7 +23,7 @@ jobs:
       name: preview
 
     steps:
-      - uses: Azure/login@v3
+      - uses: Azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3
         with:
           # excluding a client secret here will cause a login via OpenID Connect (OIDC),
           # which prevents us from having to rotate client credentials, etc
@@ -32,12 +32,14 @@ jobs:
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       # Do this before repo checkout to prevent running bundle install
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1
         with:
           ruby-version: '3.3'
 
       - name: Check out repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       # Delete web app (which will also delete the App Service plan)
       # This will succeed even if the app doesn't exist / has already been deleted

.github/workflows/demo-preview-destroy.yml

@@ -26,7 +26,7 @@ jobs:
       PR_NUMBER: ${{ github.event.number || github.event.inputs.PR_NUMBER }}
 
     steps:
-      - uses: Azure/login@v3
+      - uses: Azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3
         with:
           # excluding a client secret here will cause a login via OpenID Connect (OIDC),
           # which prevents us from having to rotate client credentials, etc
@@ -35,22 +35,24 @@ jobs:
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Check out repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Get preview app info
         run: ./.github/workflows/demo-preview-app-info.sh
 
       # Succeed despite any non-zero exit code (e.g. if there is no deployment to cancel)
       - name: 'Cancel any in progress deployments'
         run: |
-          az deployment group cancel --name ${{ env.DEPLOYMENT_NAME }} -g primer || true
+          az deployment group cancel --name ${DEPLOYMENT_NAME} -g primer || true
       # Delete web app (which will also delete the App Service plan)
       # This will succeed even if the app doesn't exist / has already been deleted
       - name: 'Delete App Service App (which will also delete the App Service plan)'
         run: |
-          az container delete -n ${{ env.APP_NAME }} -g primer -y &> /dev/null
+          az container delete -n ${APP_NAME} -g primer -y &> /dev/null
       # Untag all images under this PR's container registry repo - the container registry will automatically remove untagged images.
       # This will fail if the IMAGE_REPO doesn't exist, but we don't care
       - name: 'Untag all docker images for this PR'
         run: |
-          az acr repository delete -n primer.azurecr.io --repository ${{ env.IMAGE_REPO }} -y || true
+          az acr repository delete -n primer.azurecr.io --repository ${IMAGE_REPO} -y || true

.github/workflows/demo-production-deploy.yml

@@ -7,19 +7,22 @@ on:
     branches:
       - DO_NOT_EXECUTE_THIS_WORKFLOW
 
-permissions:
-  id-token: write # This is required for requesting the OIDC JWT for authing with Azure
-  contents: read  # This is required for actions/checkout
+permissions: {}
 
 jobs:
   build:
     if: ${{ github.repository == 'primer/view_components' }}
     runs-on: ubuntu-latest
     environment: production
+    permissions:
+      id-token: write # This is required for requesting the OIDC JWT for authing with Azure
+      contents: read  # This is required for actions/checkout
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Setup Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1
       with:
         ruby-version: '3.3'
         bundler-cache: true
@@ -28,7 +31,7 @@ jobs:
       env:
         AZURE_ACR_PASSWORD: ${{ secrets.AZURE_ACR_PASSWORD }}
       run: echo $AZURE_ACR_PASSWORD | docker login primer.azurecr.io --username GitHubActions --password-stdin
-    - uses: Azure/login@v3
+    - uses: Azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3
       with:
         # excluding a client secret here will cause a login via OpenID Connect (OIDC),
         # which prevents us from having to rotate client credentials, etc
@@ -65,22 +68,27 @@ jobs:
     runs-on: ubuntu-latest
     environment: production
     needs: build
+    permissions:
+      id-token: write # This is required for requesting the OIDC JWT for authing with Azure
+      contents: read  # This is required for actions/checkout
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Setup Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1
       with:
         ruby-version: '3.3'
         bundler-cache: true
-    - uses: actions/cache@v5.0.4
+    - uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: demo/gemfiles/vendor/bundle
         key: gems-build-kuby-main-ruby-3.3.x-${{ hashFiles('demo/gemfiles/kuby.gemfile.lock') }}
     - name: Bundle
       run: |
         gem install bundler -v '~> 2.3'
         bundle install --jobs 4 --retry 3 --gemfile demo/gemfiles/kuby.gemfile --path vendor/bundle
-    - uses: Azure/login@v3
+    - uses: Azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3
       with:
         # excluding a client secret here will cause a login via OpenID Connect (OIDC),
         # which prevents us from having to rotate client credentials, etc

.github/workflows/lint.yml

@@ -9,11 +9,17 @@ on:
       - main
     types:
       - checks_requested
+permissions: {}
 jobs:
   markdown:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Get specific changed files
       id: changed-files
       uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323
@@ -23,22 +29,29 @@ jobs:
           README.md
           CONTRIBUTING.md
           CODE_OF_CONDUCT.md
-    - uses: xt0rted/markdownlint-problem-matcher@v3
+    - uses: xt0rted/markdownlint-problem-matcher@1a5fabfb577370cfdf5af944d418e4be3ea06f27 # v3
       if: steps.changed-files.outputs.any_changed == 'true'
-    - uses: actions/setup-node@v5
+    - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
       if: steps.changed-files.outputs.any_changed == 'true'
       with:
         cache: 'npm'
     - name: Lint with Markdownlint
       if: steps.changed-files.outputs.any_changed == 'true'
       run: |
         npm ci
-        npx markdownlint-cli2 ${{ steps.changed-files.outputs.all_changed_files }}
+        npx markdownlint-cli2 ${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}
+      env:
+        STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
 
   rubocop:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Get specific changed files
       id: changed-files
       uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323
@@ -48,7 +61,7 @@ jobs:
           lib/**/*.rb
           demo/**/*.rb
           test/**/*.rb
-    - uses: ruby/setup-ruby@v1
+    - uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1
       with:
         ruby-version: '3.3'
         bundler-cache: true
@@ -57,15 +70,20 @@ jobs:
 
   erblint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Get changed files
       id: changed-files
       uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323
       with:
         files: |
           app/components/**/*.erb
-    - uses: ruby/setup-ruby@v1
+    - uses: ruby/setup-ruby@6aaa311d81eba98ae12eaffbcb63296ace0efcde # v1
       with:
         ruby-version: '3.3'
         bundler-cache: true
@@ -74,49 +92,67 @@ jobs:
 
   eslint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Get changed files
       id: changed-files
       uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323
       with:
         files: |
           app/components/**/*.ts
-    - uses: actions/setup-node@v5
+    - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
       if: steps.changed-files.outputs.any_changed == 'true'
       with:
         cache: 'npm'
     - name: Lint with ESLint
       if: steps.changed-files.outputs.any_changed == 'true'
       run: |
         npm ci
-        npx eslint --quiet ${{ steps.changed-files.outputs.all_changed_files }}
+        npx eslint --quiet ${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}
+      env:
+        STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
 
   stylelint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Get changed files
       id: changed-files
       uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323
       with:
         files: |
           app/components/**/*.pcss
           lib/postcss_mixins/*.pcss
-    - uses: actions/setup-node@v5
+    - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
       if: steps.changed-files.outputs.any_changed == 'true'
       with:
         cache: 'npm'
     - name: Lint with Stylelint
       if: steps.changed-files.outputs.any_changed == 'true'
       run: |
         npm ci
-        npx stylelint --rd -q ${{ steps.changed-files.outputs.all_changed_files }} --custom-formatter=stylelint-actions-formatters
+        npx stylelint --rd -q ${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES} --custom-formatter=stylelint-actions-formatters
+      env:
+        STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
 
   herb:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - name: Lint with Herb
       run: |
         npx @herb-tools/linter@0.8.10