[arthurschreiber]

Adds a zizmor workflow to audit our GitHub Actions setup, fixes everything it currently reports, and adds a Dependabot config so the hash-pinned actions stay current.

New zizmor workflow

.github/workflows/zizmor.yml runs zizmorcore/zizmor-action on pushes to the release branches and on all pull requests. Findings go to code scanning (the Security tab). The job fails only if zizmor itself errors, not when it reports findings. To make findings block merges, add a code scanning rule to the branch ruleset.

.gitignore ignores every dotfile (.*), which also covers .github/. zizmor respects .gitignore, so with its default input (.) it finds nothing to scan and errors out. The workflow therefore passes inputs: .github explicitly.

Fixes to existing workflows

• Hash-pinned actions: every uses: now points at a commit SHA, with the version in a trailing comment. Each SHA is the commit the old major tag pointed to, so the action code doesn't change, with one exception: claude.yml and claude-code-review.yml were on actions/checkout@v4 and now use v6.1.0 like the other workflows.
• persist-credentials: false on every checkout. semantic-release logs in with GITHUB_TOKEN itself, so the pre-release job doesn't need the token that checkout would otherwise leave in the git config.
• Token permissions:
  • nodejs.yml: contents: read for the whole workflow. The pre-release job keeps its own explicit permissions.
  • lint-pull-request-title.yml: no permissions by default, and the job gets pull-requests: read.
• pull_request_target in the PR title check: kept so the check still runs on PRs from forks, which plain pull_request doesn't support for this action. The job never checks out or runs PR code, so I suppressed zizmor's dangerous-triggers finding with an inline comment that says so.
• release.yml: removed the npm install -g npm@latest step. The job only runs npm info and npm dist-tag add, which the npm bundled with Node 22 handles, and the jq normalization from ci: handle array output from npm info --json in release workflow #1793 already copes with both npm info output formats.

Dependabot

.github/dependabot.yml checks the github-actions ecosystem weekly, groups all updates into one PR, and waits 7 days after a release before proposing it. It uses a ci commit prefix so Dependabot's PR titles pass the title lint.

Testing

• zizmor .github (v1.30.1, offline) reports no findings. Online audits couldn't run from my environment. This PR's zizmor run will cover them.
• All workflow files and dependabot.yml parse as valid YAML.
• No library code changed, so the test/build/lint steps in the PR checklist don't apply beyond this PR's CI.

🤖 Generated with Claude Code

https://claude.ai/code/session_019tyi7LR4AMma656aM8XYso

---

Generated by Claude Code

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

🟢 Approval recommended

The action pins were verified, configuration checks pass, and no unresolved correctness or security issues were found.

0 open findings

What changed in this PR

Adds automated GitHub Actions security auditing and hardens existing CI workflows.

Changes:

• Adds zizmor scanning and grouped Dependabot updates.
• Pins third-party actions and disables persisted checkout credentials.
• Restricts workflow permissions and removes unnecessary npm upgrading.

File	Description
.github/​workflows/​zizmor.yml	Adds workflow security scanning.
.github/​workflows/​release.yml	Hardens checkout and simplifies npm usage.
.github/​workflows/​nodejs.yml	Pins actions and restricts permissions.
.github/​workflows/​lint-pull-request-title.yml	Limits permissions and documents trigger safety.
.github/​workflows/​codeql-analysis.yml	Pins CodeQL and checkout actions.
.github/​workflows/​claude.yml	Pins actions and hardens checkout.
.github/​workflows/​claude-code-review.yml	Pins actions and hardens checkout.
.github/​dependabot.yml	Automates grouped action-pin updates.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.76%. Comparing base (fd1149d) to head (6f16067).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1829      +/-   ##
==========================================
+ Coverage   84.49%   84.76%   +0.27%     
==========================================
  Files          96       96              
  Lines        4720     4720              
  Branches      884      884              
==========================================
+ Hits         3988     4001      +13     
+ Misses        468      455      -13     
  Partials      264      264              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.