James Anderson 601a394582 ci: address zizmor security audit findings (#1577) ...

* ci: address zizmor security audit findings

Run `zizmor .` and address all findings:

- Pin actions to commit SHAs with version comments (unpinned-uses).
  Dependabot picks up the version comment for future bumps.
- Move `contents: write` / `id-token: write` to the publish job in
  publish.yml; set `permissions: {}` at the workflow level
  (excessive-permissions).
- Add `permissions: {}` to deploy-examples.yml workflow + scope
  smoke-test job to `contents: read` (excessive-permissions).
- Move `${{ ... }}` expansions inside run blocks into `env:` vars
  in publish.yml / benchmarks.yml / nextjs-deploy-suite.yml
  (template-injection).
- Set `persist-credentials: false` on all checkouts that don't push;
  publish.yml needs them for `git push origin v$VERSION`, so it
  carries an inline `zizmor: ignore[artipacked]` instead.
- Keep dependabot's 1-day cooldown but annotate with `zizmor: ignore`
  (intentional fast cooldown).

`zizmor .` is now clean.

* ci: add zizmor GitHub Actions workflow

Run zizmor on every push to main and every PR via the upstream
`zizmorcore/zizmor-action`. Findings surface in the GitHub Code
Scanning UI (Security → Code scanning alerts).

* ci(publish): explain zizmor artipacked ignore

2026-05-22 19:41:30 +01:00

..

action.yml

ci: address zizmor security audit findings (#1577)

2026-05-22 19:41:30 +01:00