From fbd575b737c357ce57658f0fb50c051eea9b1061 Mon Sep 17 00:00:00 2001
From: Carl Tashian <carl@smallstep.com>
Date: Tue, 3 Mar 2026 16:15:10 -0800
Subject: [PATCH 1/4] Add actionci.yml

Add caller workflow for actionci (actionlint + zizmor + frizbee).
Add permissions blocks and zizmor suppression config.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/actionci.yml       | 22 ++++++++++++++++++++++
 .github/workflows/ci.yml             |  3 +++
 .github/workflows/code-scan-cron.yml |  5 +++++
 .github/zizmor.yml                   | 12 ++++++++++++
 4 files changed, 42 insertions(+)
 create mode 100644 .github/workflows/actionci.yml
 create mode 100644 .github/zizmor.yml

diff --git a/.github/workflows/actionci.yml b/.github/workflows/actionci.yml
new file mode 100644
index 0000000..6086cd4
--- /dev/null
+++ b/.github/workflows/actionci.yml
@@ -0,0 +1,22 @@
+name: Action CI
+
+on:
+  push:
+    tags-ignore:
+    - 'v*'
+    branches:
+    - "main"
+  pull_request:
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  actionci:
+    permissions:
+      contents: read
+      security-events: write
+    uses: smallstep/workflows/.github/workflows/actionci.yml@main
+    secrets: inherit
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0f37823..3d03cc5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,6 +16,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   ci:
     permissions:
diff --git a/.github/workflows/code-scan-cron.yml b/.github/workflows/code-scan-cron.yml
index 5b9bd91..9669845 100644
--- a/.github/workflows/code-scan-cron.yml
+++ b/.github/workflows/code-scan-cron.yml
@@ -4,6 +4,11 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
 jobs:
   code-scan:
     permissions:
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..92a6146
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,12 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "smallstep/*": ref-pin
+  secrets-inherit:
+    disable: true
+  ref-confusion:
+    disable: true
+  dangerous-triggers:
+    ignore:
+      - triage.yml

From 2de673a56c251572f5b2906de81371604365250b Mon Sep 17 00:00:00 2001
From: Carl Tashian <carl@smallstep.com>
Date: Thu, 5 Mar 2026 11:00:55 -0800
Subject: [PATCH 2/4] Suppress dependabot-cooldown in zizmor config

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/zizmor.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 92a6146..0518491 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -10,3 +10,5 @@ rules:
   dangerous-triggers:
     ignore:
       - triage.yml
+  dependabot-cooldown:
+    disable: true

From 0c3ec32510e96e0667825cbf3b44ff8d1cc2efcf Mon Sep 17 00:00:00 2001
From: Carl Tashian <carl@smallstep.com>
Date: Thu, 5 Mar 2026 11:27:56 -0800
Subject: [PATCH 3/4] Fix zizmor errors: pin actions, fix bot-conditions,
 deduplicate permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Pin unpinned actions to SHA digests via frizbee
- Fix spoofable bot actor checks (github.actor → github.event.pull_request.user.login)
- Remove duplicate permissions blocks
- Suppress low-confidence cache-poisoning findings
- Pin postgres container image

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/dependabot-auto-merge.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 471eeda..319b427 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -8,11 +8,11 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1.1.1
+        uses: dependabot/fetch-metadata@a3e5f86ae9f2f49b441498973ddec20035d326b8 # v1.1.1
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Enable auto-merge for Dependabot PRs

From 75bbd80e3c04b6e4fd7c537ac187f3859860bf8c Mon Sep 17 00:00:00 2001
From: Carl Tashian <carl@smallstep.com>
Date: Thu, 5 Mar 2026 14:06:05 -0800
Subject: [PATCH 4/4] Add permissions to triage.yml to fix zizmor
 excessive-permissions warning

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/triage.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index f1363a4..d6e1e43 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -12,5 +12,9 @@ on:
 
 jobs:
   triage:
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
     uses: smallstep/workflows/.github/workflows/triage.yml@main
     secrets: inherit