Add zizmor workflow for action security checks (#9228)

* Add zizmor workflow for action security checks

https://docs.zizmor.sh/integrations/#github-actions
https://github.com/zizmorcore/zizmor-action

To avoid pushing unsafe actions and also for performing the scan automatically on each zizmor upgrade, in case there are any new unsafe behaviors to find.

* Zizmor fixes

* Set dependabot cooldowns to 7 days

* Fix workflow concurrency and improve code quality

* Use pedantic persona in zizmor workflow

.github/dependabot.yml

@@ -6,10 +6,14 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       eslint:
         patterns:
@@ -23,7 +27,11 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "composer"
     directory: "/lib/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7

.github/workflows/docker-publish.yml

@@ -8,14 +8,21 @@ on:
     types: [published]
   workflow_dispatch:
 
-permissions:
-  contents: read
-  packages: write
+# To ensure that if the latest push finishes faster than an earlier run, the previous run won't
+# overwrite it later. (by queueing the runs)
+concurrency:
+  group: docker-publish-${{ github.ref_name }} # e.g. docker-publish-edge, docker-publish-latest, docker-publish-1.29.1
+  cancel-in-progress: false
+
+permissions: {}
 
 jobs:
   build-container-image:
     name: Build Docker image ${{ matrix.name }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write # For uploading to the GitHub container registry (ghcr.io)
     strategy:
       matrix:
         include:
@@ -47,6 +54,8 @@ jobs:
 
     - name: Checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Get FreshRSS version
       run: |

.github/workflows/dockerhub-description.yml

@@ -11,12 +11,19 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: update-dockerhub-description
+  cancel-in-progress: false # Queue the description updates
+
 jobs:
   dockerhub-description:
+    name: dockerhub-description
     if: github.repository_owner == 'FreshRSS'
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Update repo description
       uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa

.github/workflows/jekyll-gh-pages.yml

@@ -11,11 +11,7 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
-# Sets permissions of the GITHUB_TOKEN to allow deployment to GitHub Pages
-permissions:
-  contents: read
-  pages: write
-  id-token: write
+permissions: {}
 
 # Allow only one concurrent deployment, skipping runs queued between the run in-progress and latest queued.
 # However, do NOT cancel in-progress runs as we want to allow these production deployments to complete.
@@ -26,10 +22,16 @@ concurrency:
 jobs:
   # Build job
   build:
+    name: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pages: write # For preparing the page deployment
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Ruby
         uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b
         with:
@@ -48,10 +50,14 @@ jobs:
 
   # Deployment job
   deploy:
+    name: deploy
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
+    permissions:
+      pages: write # For deploying the page
+      id-token: write # For authorizing the deployment
     needs: build
     steps:
       - name: Deploy to GitHub Pages

.github/workflows/tests.yml

@@ -9,15 +9,22 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: tests-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
 
   tests:
+    name: tests
     # https://github.com/actions/virtual-environments
     runs-on: ubuntu-26.04
 
     steps:
     - name: Git checkout source code
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # Composer tests
 

.github/workflows/zizmor.yml

@@ -0,0 +1,30 @@
+name: Zizmor CI
+
+on:
+  push:
+    branches: [ edge ]
+  pull_request:
+    branches: [ edge ]
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-26.04
+    permissions:
+      security-events: write # So that the findings can be listed in the "Security" tab under the "Code scanning" section
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          persona: pedantic # https://docs.zizmor.sh/usage/#using-personas