From 6820dbf305a5c2575fbc6c928fec72b802830629 Mon Sep 17 00:00:00 2001
From: Christopher Hiller <boneskull@boneskull.com>
Date: Thu, 16 Jul 2026 15:41:39 -0700
Subject: [PATCH] chore(ci): apply zizmor fixes, add zizmor, split lint into
 its own workflow

---
 .github/workflows/ci.yml               | 21 +++---------
 .github/workflows/lint.yml             | 44 ++++++++++++++++++++++++++
 .github/workflows/pr-assign-author.yml | 13 ++++++--
 .github/workflows/release.yml          | 16 ++++++----
 .github/zizmor.yml                     |  3 ++
 5 files changed, 72 insertions(+), 25 deletions(-)
 create mode 100644 .github/workflows/lint.yml
 create mode 100644 .github/zizmor.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6566951..b14a1c6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-name: CI
+name: Build & Test
 
 on:
   push:
@@ -15,26 +15,13 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  lint:
-    name: Lint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
-        with:
-          go-version-file: go.mod
-
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
-        with:
-          version: v2.12.2
-
   test:
     name: Test
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
@@ -63,6 +50,8 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..6b07e65
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,44 @@
+name: Lint
+
+on:
+  push:
+    paths-ignore:
+      - 'CHANGELOG.md'
+  pull_request:
+    paths-ignore:
+      - 'CHANGELOG.md'
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        with:
+          go-version-file: go.mod
+
+      - parallel:
+        - name: golangci-lint
+          uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9
+          with:
+            version: v2.12.2
+  
+        - name: Run zizmor
+          uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+          with:
+            persona: pedantic
+            advanced-security: 'false'
+            annotations: 'true'
+            version: '1.27.0'
+            # TODO: add enable strict collection when the action enables it
diff --git a/.github/workflows/pr-assign-author.yml b/.github/workflows/pr-assign-author.yml
index db55791..af7f207 100644
--- a/.github/workflows/pr-assign-author.yml
+++ b/.github/workflows/pr-assign-author.yml
@@ -1,14 +1,21 @@
 name: Auto-assign PR to author
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: false
+
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, reopened]
+    branches: [main]
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   assign-author:
+    name: Run toshimaru/auto-author-assign action
+    permissions:
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
       - uses: toshimaru/auto-author-assign@3e19bfc990cb1cf0589dce95e9f75289bb1e22de # v3.0.3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 06c1961..218f3cf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,14 +8,16 @@ on:
 concurrency:
   group: ${{ github.workflow }}
 
-permissions:
-  contents: write
-  pull-requests: write
-  id-token: write
-  attestations: write
+permissions: {}
 
 jobs:
   release:
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+      attestations: write
+    name: Release
     runs-on: ubuntu-latest
     steps:
       - name: Release Please
@@ -25,10 +27,12 @@ jobs:
       - name: Checkout
         if: ${{ steps.release.outputs.release_created }}
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Build and upload binaries
         if: ${{ steps.release.outputs.release_created }}
-        uses: cli/gh-extension-precompile@v2
+        uses: cli/gh-extension-precompile@76961aa3bd1123d0a6fd42d0a41aca0696937c39 # v2.2.0
         with:
           generate_attestations: true
           go_version_file: go.mod
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..633f5df
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,3 @@
+rules:
+  undocumented-permissions:
+    disable: true