From 34f7ceedee9fbcd6b76be202af881e912aee63d9 Mon Sep 17 00:00:00 2001
From: Dawid Weiss <dawid.weiss@carrotsearch.com>
Date: Tue, 13 Oct 2026 16:33:54 +0200
Subject: [PATCH] Add a zizmor workflow audit and harden the check workflow.

Ported from nsf-document-importer: audits everything under .github with
zizmor (pedantic persona) on pushes and pull requests that touch it. All
actions used here are public, so the online audits fall back to the
default workflow token when no dedicated ZIZMOR_GH_TOKEN is configured.

Bring the check workflow into compliance: upgrade actions to their
latest releases and pin them to commit hashes, stop persisting the
checkout credentials, declare read-only permissions, add a concurrency
group, a timeout and a job name.

Add a Dependabot config for GitHub Actions updates.
---
 .github/dependabot.yml       | 16 ++++++++++++++
 .github/workflows/check.yml  | 21 +++++++++++++++---
 .github/workflows/zizmor.yml | 42 ++++++++++++++++++++++++++++++++++++
 .github/zizmor.yml           |  8 +++++++
 4 files changed, 84 insertions(+), 3 deletions(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/zizmor.yml
 create mode 100644 .github/zizmor.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..09c32a2
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directories:
+      - "/"
+    open-pull-requests-limit: 25
+    schedule:
+      interval: monthly
+    commit-message:
+      prefix: ci
+    labels: [dependencies]
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 44a325f..517c9b2 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -4,20 +4,35 @@ on:
   push:
   pull_request:
 
+# The build only reads the repository.
+permissions:
+  contents: read
+
+# A newer push to the same branch or pull request supersedes a run still in progress.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   check:
+    name: gradle check
     runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: '17'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
 
       - name: Run gradlew check
         run: ./gradlew check
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..8979e2d
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,42 @@
+name: Workflow security
+
+# Audits the GitHub Actions workflows with zizmor whenever anything under .github changes.
+on:
+  push:
+    branches: [master]
+    paths: [".github/**"]
+  pull_request:
+    branches: [master]
+    paths: [".github/**"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    name: Audit workflows with zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884 # v10.3.0
+
+      - name: Run zizmor
+        # The online audits (impostor commits, known-vulnerable actions, ref confusion) resolve
+        # every referenced action through the GitHub API. All actions used here are public, so the
+        # default workflow token is sufficient; a dedicated ZIZMOR_GH_TOKEN takes precedence when
+        # it is configured.
+        env:
+          ZIZMOR_GH_TOKEN: ${{ secrets.ZIZMOR_GH_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          GH_TOKEN="${ZIZMOR_GH_TOKEN:-${GITHUB_TOKEN}}" uvx zizmor==1.30.1 --no-progress --persona=pedantic .github/
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..8b8a13c
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,8 @@
+# Configuration for zizmor, see .github/workflows/zizmor.yml.
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # Our own shared infra actions deliberately track a branch.
+        "carrotsearch/*": ref-pin
+        "*": hash-pin