From bae049bfc27e35a0a33622bed9d49494adc0a523 Mon Sep 17 00:00:00 2001
From: Claudio Pilotti <claudio.pilotti@seantis.ch>
Date: Wed, 29 Jul 2026 15:59:21 +0200
Subject: [PATCH] Check GitHub actions with zizmor (SEA-2065)

---
 .github/workflows/docker-publish.yml |  4 +++-
 .github/workflows/stubtest.yml       | 10 +++++++--
 .github/workflows/tests.yml          | 10 +++++++--
 .github/workflows/zizmor.yml         | 33 ++++++++++++++++++++++++++++
 .pre-commit-config.yaml              |  4 ++++
 5 files changed, 56 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 13c369e..32ee303 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -35,7 +35,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       # Install the cosign tool except on PR
       # https://github.com/sigstore/cosign-installer
diff --git a/.github/workflows/stubtest.yml b/.github/workflows/stubtest.yml
index 26f207c..0203a32 100644
--- a/.github/workflows/stubtest.yml
+++ b/.github/workflows/stubtest.yml
@@ -5,9 +5,13 @@ on:
   schedule:
     - cron: '0 7 * * 1'  # run once a week on monday morning
 
+permissions: {}
+
 jobs:
   stubtest:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
     - name: Install packages
@@ -30,10 +34,12 @@ jobs:
           postgresql-contrib
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
 
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
       with:
         python-version: '3.10'
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 13b1f7d..a9a0f4c 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -5,6 +5,8 @@ on:
   push:
   pull_request:
 
+permissions: {}
+
 jobs:
 
   tests:
@@ -12,6 +14,8 @@ jobs:
       fail-fast: false
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
     name: Tests
@@ -37,7 +41,9 @@ jobs:
           postgresql-contrib
 
     - name: Checkout repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
 
     - name: Get branch name (merge)
       if: github.event_name != 'pull_request'
@@ -54,7 +60,7 @@ jobs:
              >> $GITHUB_ENV
 
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
       with:
         python-version: '3.10'
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..6d0b1ea
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,33 @@
+# https://docs.zizmor.sh/integrations/#github-actions
+name: Zizmor (GitHub Actions Security)
+
+on:
+  push:
+    paths:
+      - '.github/workflows/**'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # Required for private repos
+      actions: read # Required for private repos
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        with:
+          advanced-security: false
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 6d2c566..d4eec9f 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -55,3 +55,7 @@ repos:
         rev: v8.24.2
         hooks:
           - id: gitleaks
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.28.0
+    hooks:
+      - id: zizmor