From d1314018ccccaad750d2f79c3d4cda385c7967c9 Mon Sep 17 00:00:00 2001
From: Daniel Hast <hast.daniel@protonmail.com>
Date: Sat, 7 Mar 2026 14:29:15 -0500
Subject: [PATCH] ci: pin third-party action dependencies to commit hashes

This improves CI security by ensuring that action dependencies cannot be
changed by upstream repositories without updating the use of the
dependency in this repo.

Official GitHub-maintained actions are excluded from this requirement
and are left pinned by a tag instead of a commit hash. This action
dependency pinning policy is codified in `.github/zizmor.yml` so that
Zizmor (a static analysis tool for GitHub Actions) doesn't flag these as
unpinned dependencies.

Also add cooldown timer for Dependabot. This fixes these two Zizmor
audits:
* https://docs.zizmor.sh/audits/#dependabot-cooldown
* https://docs.zizmor.sh/audits/#unpinned-uses
---
 .github/dependabot.yml             | 2 ++
 .github/workflows/backport.yml     | 2 +-
 .github/workflows/test.yml         | 6 +++---
 .github/workflows/test_windows.yml | 2 +-
 .github/zizmor.yml                 | 6 ++++++
 5 files changed, 13 insertions(+), 5 deletions(-)
 create mode 100644 .github/zizmor.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e96fd5286f..70f4a2749a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,3 +6,5 @@ updates:
       interval: "daily"
     commit-message:
       prefix: "ci"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index f29f0bad8d..20e8c8e94f 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -21,7 +21,7 @@ jobs:
 
       - name: Create backport PR
         id: backport
-        uses: korthout/backport-action@v4
+        uses: korthout/backport-action@4aaf0e03a94ff0a619c9a511b61aeb42adea5b02 # v4.2.0
         with:
           pull_title: "${pull_title}"
           label_pattern: "^ci:backport ([^ ]+)$"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 68a2344bc7..68a065acbd 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -236,7 +236,7 @@ jobs:
       OPTS: -Doptimize=ReleaseSafe
     steps:
       - uses: actions/checkout@v6
-      - uses: mlugg/setup-zig@v2
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
         with:
           version: 0.15.2
       - run: sudo apt-get install -y inotify-tools
@@ -256,7 +256,7 @@ jobs:
     name: build using zig build (macos 15)
     steps:
       - uses: actions/checkout@v6
-      - uses: mlugg/setup-zig@v2
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
         with:
           version: 0.15.2
 
@@ -270,7 +270,7 @@ jobs:
     name: build using zig build (windows)
     steps:
       - uses: actions/checkout@v6
-      - uses: mlugg/setup-zig@v2
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
         with:
           version: 0.15.2
 
diff --git a/.github/workflows/test_windows.yml b/.github/workflows/test_windows.yml
index b23d9bed07..6f08fd1238 100644
--- a/.github/workflows/test_windows.yml
+++ b/.github/workflows/test_windows.yml
@@ -66,7 +66,7 @@ jobs:
           exit $exitCode
 
       - if: ${{ matrix.test == 'old' }}
-        uses: msys2/setup-msys2@v2
+        uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0
         with:
           update: true
           install: unzip
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000000..4241b397b0
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,6 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: ref-pin
+        github/*: ref-pin