ci: add reusable Security Scan workflow (zizmor), pin actions to SHAs

.github/actions/check-release/action.yml

@@ -13,28 +13,29 @@ runs:
   using: 'composite'
   steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         ref: refs/tags/${{ inputs.tag }}
         fetch-depth: 0
 
     - name: Check if release exists and verify author
       shell: bash
       run: |
-        echo "Checking if release exists for tag ${{ inputs.tag }}..."
-        if gh release view "${{ inputs.tag }}" &> /dev/null; then
-          echo "::error::Release for tag ${{ inputs.tag }} already exists!"
+        echo "Checking if release exists for tag ${TAG}..."
+        if gh release view "${TAG}" &> /dev/null; then
+          echo "::error::Release for tag ${TAG} already exists!"
           exit 1
         fi
-        
+
         echo "Verifying commit author..."
-        EXPECTED_AUTHOR="${{ inputs.expected_author }}"
         AUTHOR=$(git show -s --format='%ae' HEAD)
         if [[ $AUTHOR != $EXPECTED_AUTHOR ]]; then
           echo "::error::Expected author email to be '$EXPECTED_AUTHOR', but got '$AUTHOR'. Aborting release."
           exit 1
         fi
-        
+
         echo "All checks passed: Tag exists, no release found, and author verified."
       env:
-        GH_TOKEN: ${{ github.token }}
+        GH_TOKEN: ${{ github.token }}
+        TAG: ${{ inputs.tag }}
+        EXPECTED_AUTHOR: ${{ inputs.expected_author }}

.github/actions/tag-release/action.yml

@@ -23,29 +23,33 @@ runs:
     - name: Determine tag
       id: determine-tag
       shell: bash
+      env:
+        INPUT_TAG: ${{ inputs.tag }}
+        EXPECTED_AUTHOR: ${{ inputs.email }}
+        GIT_USERNAME: ${{ inputs.username }}
+        GIT_EMAIL: ${{ inputs.email }}
       run: |
-        if [[ -n "${{ inputs.tag }}" ]]; then
-          echo "Using provided tag: ${{ inputs.tag }}"
-          echo "tag=${{ inputs.tag }}" >> $GITHUB_OUTPUT
+        if [[ -n "${INPUT_TAG}" ]]; then
+          echo "Using provided tag: ${INPUT_TAG}"
+          echo "tag=${INPUT_TAG}" >> $GITHUB_OUTPUT
           echo "is_new_tag=false" >> $GITHUB_OUTPUT
         else
           echo "No tag provided, will create a new one"
           echo "is_new_tag=true" >> $GITHUB_OUTPUT
-          
+
           # Verify author
-          EXPECTED_AUTHOR="${{ inputs.email }}"
           AUTHOR=$(git show -s --format='%ae' HEAD)
           if [[ $AUTHOR != $EXPECTED_AUTHOR ]]; then
             echo "ERROR: Expected author email to be '$EXPECTED_AUTHOR', but got '$AUTHOR'. Aborting release."
             exit 1
           else
             echo "Verified author email ($AUTHOR) is as expected ($EXPECTED_AUTHOR)"
           fi
-          
+
           # Configure git
-          git config user.name "${{ inputs.username }}"
-          git config user.email "${{ inputs.email }}"
-          
+          git config user.name "${GIT_USERNAME}"
+          git config user.email "${GIT_EMAIL}"
+
           COMMIT_TITLE=$(git show -s --format='%s' HEAD)
           NEXT_SEMVER=$(python -c 'import sys, re; print(re.match(r"chore\(release\): ([0-9]+\.[0-9]+\.[0-9]+).*", sys.argv[1]).group(1))' "$COMMIT_TITLE")
 

.github/dependabot.yml

@@ -0,0 +1,10 @@
+# Dependabot proposes commit-SHA bumps for the GitHub Actions pinned in this
+# repo's reusable workflows and composite actions. A human reviews the bump here
+# once and every consuming repo picks it up via its @mainline reference, so no
+# per-consumer Dependabot config is needed.
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/reusable_bump.yml

@@ -18,14 +18,14 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: mainline
           fetch-depth: 0
           token: ${{ secrets.CI_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.9'
 
@@ -35,10 +35,12 @@ jobs:
           git config --local user.name ${{secrets.USER}}
 
       - name: NextSemver
+        env:
+          FORCE_VERSION_BUMP: ${{ inputs.force_version_bump }}
         run: |
           BUMP_ARGS=""
-          if [[ "${{ inputs.force_version_bump }}" != "" ]]; then
-            BUMP_ARGS="$BUMP_ARGS --${{ inputs.force_version_bump }}"
+          if [[ "${FORCE_VERSION_BUMP}" != "" ]]; then
+            BUMP_ARGS="$BUMP_ARGS --${FORCE_VERSION_BUMP}"
           fi
 
           # Backup actual changelog to preserve its contents

.github/workflows/reusable_codeql.yml

@@ -23,15 +23,15 @@ jobs:
       security-events: write
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
      # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3.36.3
       with:
         queries: +security-and-quality
         languages: ${{inputs.languages}}
         build-mode: ${{inputs.mode }}
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@411c4c9a36b3fca4d674f06b6396b2c6d23522c6 # v3.36.3

.github/workflows/reusable_extract_pr_details.yml

@@ -35,7 +35,7 @@ jobs:
       pr_action: ${{ steps.extract-pr-details.outputs.pr_action }}
     steps:
       - name: Download PR artifact
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         env:
           WORKFLOW_ID: ${{ inputs.record_pr_workflow_id }}
           ARTIFACT_NAME: ${{ inputs.artifact_name }}

.github/workflows/reusable_label_pr.yml

@@ -22,7 +22,10 @@ jobs:
     steps:
       - name: Add label to PR
         run: |
-          echo "Adding label '${{ inputs.label_name }}' to PR #${{ inputs.pr_number }}"
-          gh pr edit ${{ inputs.pr_number }} --add-label "${{ inputs.label_name }}" --repo ${{ github.repository }}
+          echo "Adding label '${LABEL_NAME}' to PR #${PR_NUMBER}"
+          gh pr edit "${PR_NUMBER}" --add-label "${LABEL_NAME}" --repo "${GH_REPO}"
         env:
           GITHUB_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ inputs.pr_number }}
+          LABEL_NAME: ${{ inputs.label_name }}
+          GH_REPO: ${{ github.repository }}

.github/workflows/reusable_maturin_prerelease.yml

@@ -41,31 +41,33 @@ jobs:
         platform: ${{ fromJson(inputs.platforms) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: refs/tags/${{ inputs.tag }}
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
       - name: Inject version
         if: inputs.version-script != ''
-        run: ${{ inputs.version-script }}
+        env:
+          VERSION_SCRIPT: ${{ inputs.version-script }}
+        run: "$VERSION_SCRIPT"
         shell: bash
 
       - name: Build wheel
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           target: ${{ matrix.platform.target }}
           manylinux: ${{ matrix.platform.manylinux || 'auto' }}
           rust-toolchain: stable
           args: --release --out dist
 
       - name: Upload wheel
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: wheels-${{ matrix.platform.os }}-${{ matrix.platform.target }}
           path: dist/*.whl
@@ -76,29 +78,31 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: refs/tags/${{ inputs.tag }}
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
       - name: Inject version
         if: inputs.version-script != ''
-        run: ${{ inputs.version-script }}
+        env:
+          VERSION_SCRIPT: ${{ inputs.version-script }}
+        run: "$VERSION_SCRIPT"
         shell: bash
 
       - name: Build sdist
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@e83996d129638aa358a18fbd1dfb82f0b0fb5d3b # v1.51.0
         with:
           command: sdist
           args: --out dist
 
       - name: Upload sdist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: sdist
           path: dist/*.tar.gz
@@ -109,7 +113,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           path: dist
           merge-multiple: true
@@ -123,7 +127,7 @@ jobs:
       # build-artifact/dist/* glob). A single path strips the directory name.
       - run: mkdir -p dist_extras
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: build-artifact
           path: |

.github/workflows/reusable_prerelease.yml

@@ -17,7 +17,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: refs/tags/${{inputs.tag}}
           fetch-depth: 0
@@ -29,7 +29,7 @@ jobs:
           hatch -v build
 
       - name: UploadArtifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: build-artifact
           path: |

.github/workflows/reusable_publish.yml

@@ -10,7 +10,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
@@ -35,14 +35,14 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: release
           fetch-depth: 0
           token: ${{ secrets.CI_TOKEN }}
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.9'
 
@@ -82,7 +82,7 @@ jobs:
           hatch -v build
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
           role-to-assume: ${{ secrets.AWS_PGP_KEY_SECRET_ROLE }}
           aws-region: us-west-2
@@ -119,14 +119,14 @@ jobs:
       id-token: write
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
           role-to-assume: ${{ secrets.AWS_CODEBUILD_RELEASE_PUBLISH_ROLE }}
           aws-region: us-west-2
           mask-aws-account-id: true
 
       - name: Run CodeBuild
-        uses: aws-actions/aws-codebuild-run-build@v1
+        uses: aws-actions/aws-codebuild-run-build@7e46c3fa1c1f217e26a73712796b1f78938b534b # v1.0.18
         with:
           project-name: ${{ github.event.repository.name }}-release-Publish
           hide-cloudwatch-logs: true
@@ -147,20 +147,20 @@ jobs:
       CUSTOMER_REPOSITORY: ${{ secrets.CUSTOMER_REPOSITORY }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           ref: release
           fetch-depth: 0
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
           role-to-assume: ${{ secrets.AWS_CODEARTIFACT_ROLE }}
           aws-region: us-west-2
           mask-aws-account-id: true
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.9'
 

.github/workflows/reusable_publish_python.yml

@@ -15,14 +15,14 @@ jobs:
       id-token: write
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
           role-to-assume: ${{ secrets.AWS_CODEBUILD_RELEASE_PUBLISH_ROLE }}
           aws-region: us-west-2
           mask-aws-account-id: true
 
       - name: Run CodeBuild
-        uses: aws-actions/aws-codebuild-run-build@v1
+        uses: aws-actions/aws-codebuild-run-build@7e46c3fa1c1f217e26a73712796b1f78938b534b # v1.0.18
         with:
           project-name: ${{ github.event.repository.name }}-release-Publish
           hide-cloudwatch-logs: true