Why:
GitHub Actions security findings should fail CI before new workflow
changes can regress the hardening work.
Impact:
Workflow-related pull requests now run zizmor against all GitHub Actions
workflows. Dependabot can update the pinned zizmor package version.
Before/After:
Before, zizmor was only run manually; after, workflow changes have a
dedicated CI security audit.
Technical Overview:
Add a path-scoped zizmor check workflow for workflow-file changes and
manual dispatch.
Install zizmor from a pinned requirements file inside a local virtualenv
so the runner's system Python packaging policy does not affect the job.
Run zizmor with strict collection and GitHub Actions annotation output
against the complete .github/workflows directory.
Add a Dependabot pip entry for .github so zizmor version updates can be
proposed automatically without making the CI install unpinned.
With the help of AI-Agents: Codex
Why:
Pinned GitHub Actions improve workflow integrity, but they should not freeze
CI on old action commits indefinitely. Automated update pull requests give us a
reviewable path for security and maintenance updates after pinning.
Impact:
Dependabot will open weekly GitHub Actions update pull requests.
Before/After:
Before, action updates were manual; after, Dependabot proposes them weekly.
Technical Overview:
Add a Dependabot v2 configuration for the `github-actions` ecosystem at the
repository root. Limit open update pull requests to keep review load bounded.
Apply the existing CI and cleanup labels and use a short CI commit-message
prefix so update PRs are easy to identify in the history.
With the help of AI-Agents: Harvey
