From 893b225fc7d87eb674d5cfc401b46fda2cf8595d Mon Sep 17 00:00:00 2001
From: Nicolas Ettlin <nicolas@convex.dev>
Date: Fri, 22 May 2026 11:46:32 -0700
Subject: [PATCH 1/2] Add a new GitHub action to lint workflows (#69)

* Add a new GitHub action to lint workflows

* Fix workflows
---
 .github/workflows/lint-workflows.yml | 41 ++++++++++++++++++++++++++++
 .github/workflows/test.yml           |  4 +++
 2 files changed, 45 insertions(+)
 create mode 100644 .github/workflows/lint-workflows.yml

diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
new file mode 100644
index 0000000..3962cb0
--- /dev/null
+++ b/.github/workflows/lint-workflows.yml
@@ -0,0 +1,41 @@
+name: Lint workflows
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+  pull_request:
+    branches: ["**"]
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8 # v2.1.2
+
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 59e97d1..6eb3b12 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -9,6 +9,8 @@ on:
   pull_request:
     branches: ["**"]
 
+permissions: {}
+
 jobs:
   check:
     name: Test and lint
@@ -17,6 +19,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Node setup
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6

From b24a2f0dcefa47d9ed032b923f4ab6d32bf71d60 Mon Sep 17 00:00:00 2001
From: Nicolas Ettlin <nicolas@convex.dev>
Date: Fri, 22 May 2026 14:33:08 -0700
Subject: [PATCH 2/2] Fix actions/checkout

---
 .github/workflows/lint-workflows.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
index 3962cb0..1065900 100644
--- a/.github/workflows/lint-workflows.yml
+++ b/.github/workflows/lint-workflows.yml
@@ -34,6 +34,8 @@ jobs:
     name: zizmor
     runs-on: ubuntu-latest
     timeout-minutes: 5
+    permissions:
+      security-events: write
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with: