From 8a631f3b0bddc05b01cfc1c91bcde7d348dd3743 Mon Sep 17 00:00:00 2001
From: botandbang <337765928+botandbang@users.noreply.github.com>
Date: Thu, 22 Oct 2026 12:11:20 -0400
Subject: [PATCH 1/2] ci: pin actions, scope token permissions, and scan
 workflows

Pin checkout, setup-node and create-pull-request to release SHAs, set
persist-credentials: false on every checkout, and give every workflow
top-level permissions. Add zizmor with adhoc-packages off, since
.npmrc sets package-lock=false. Remove the four NPM_TOKEN publish
workflows; release.yml publishes over trusted publishing.
---
 .github/workflows/lint-aliases.yml          |  9 +++++--
 .github/workflows/lint-core.yml             |  9 +++++--
 .github/workflows/lint-fetchindex.yml       |  9 +++++--
 .github/workflows/lint-newest.yml           |  9 +++++--
 .github/workflows/lint-oldest.yml           |  9 +++++--
 .github/workflows/lint-opt.yml              |  9 +++++--
 .github/workflows/lint-parsefiles.yml       |  9 +++++--
 .github/workflows/lint-ranges.yml           |  9 +++++--
 .github/workflows/lint-static.yml           |  9 +++++--
 .github/workflows/lint-translate.yml        |  9 +++++--
 .github/workflows/lint.yml                  |  9 +++++--
 .github/workflows/nightly-static-build.yaml | 11 ++++++---
 .github/workflows/publish-core.yml          | 23 ------------------
 .github/workflows/publish-fetchindex.yml    | 23 ------------------
 .github/workflows/publish-newest.yml        | 23 ------------------
 .github/workflows/publish-static.yml        | 23 ------------------
 .github/workflows/tests-core.yml            |  9 +++++--
 .github/workflows/tests-fetchindex.yml      |  9 +++++--
 .github/workflows/tests-newest.yml          |  9 +++++--
 .github/workflows/tests-oldest.yml          |  9 +++++--
 .github/workflows/tests-opt.yml             |  9 +++++--
 .github/workflows/tests-parsefiles.yml      |  9 +++++--
 .github/workflows/tests-ranges.yml          |  9 +++++--
 .github/workflows/tests-static.yml          |  9 +++++--
 .github/workflows/tests-translate.yml       |  9 +++++--
 .github/workflows/zizmor.yml                | 26 +++++++++++++++++++++
 .github/zizmor.yml                          |  4 ++++
 27 files changed, 178 insertions(+), 135 deletions(-)
 delete mode 100644 .github/workflows/publish-core.yml
 delete mode 100644 .github/workflows/publish-fetchindex.yml
 delete mode 100644 .github/workflows/publish-newest.yml
 delete mode 100644 .github/workflows/publish-static.yml
 create mode 100644 .github/workflows/zizmor.yml
 create mode 100644 .github/zizmor.yml

diff --git a/.github/workflows/lint-aliases.yml b/.github/workflows/lint-aliases.yml
index be3730c..ba04e4a 100644
--- a/.github/workflows/lint-aliases.yml
+++ b/.github/workflows/lint-aliases.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w aliases --include-workspace-root
diff --git a/.github/workflows/lint-core.yml b/.github/workflows/lint-core.yml
index c7ae4c3..c14c6cc 100644
--- a/.github/workflows/lint-core.yml
+++ b/.github/workflows/lint-core.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w core --include-workspace-root
diff --git a/.github/workflows/lint-fetchindex.yml b/.github/workflows/lint-fetchindex.yml
index f5829d7..29ba51b 100644
--- a/.github/workflows/lint-fetchindex.yml
+++ b/.github/workflows/lint-fetchindex.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w fetchindex --include-workspace-root
diff --git a/.github/workflows/lint-newest.yml b/.github/workflows/lint-newest.yml
index dd50636..b542e6b 100644
--- a/.github/workflows/lint-newest.yml
+++ b/.github/workflows/lint-newest.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w newest --include-workspace-root
diff --git a/.github/workflows/lint-oldest.yml b/.github/workflows/lint-oldest.yml
index 93dc038..cdcbc04 100644
--- a/.github/workflows/lint-oldest.yml
+++ b/.github/workflows/lint-oldest.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w oldest --include-workspace-root
diff --git a/.github/workflows/lint-opt.yml b/.github/workflows/lint-opt.yml
index de7d5d0..d4ad1a9 100644
--- a/.github/workflows/lint-opt.yml
+++ b/.github/workflows/lint-opt.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w opt --include-workspace-root
diff --git a/.github/workflows/lint-parsefiles.yml b/.github/workflows/lint-parsefiles.yml
index f6d94eb..1f71f86 100644
--- a/.github/workflows/lint-parsefiles.yml
+++ b/.github/workflows/lint-parsefiles.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w parsefiles --include-workspace-root
diff --git a/.github/workflows/lint-ranges.yml b/.github/workflows/lint-ranges.yml
index 597d91f..5c977e7 100644
--- a/.github/workflows/lint-ranges.yml
+++ b/.github/workflows/lint-ranges.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w ranges --include-workspace-root
diff --git a/.github/workflows/lint-static.yml b/.github/workflows/lint-static.yml
index 5510dff..4e09cd7 100644
--- a/.github/workflows/lint-static.yml
+++ b/.github/workflows/lint-static.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w static --include-workspace-root
diff --git a/.github/workflows/lint-translate.yml b/.github/workflows/lint-translate.yml
index 6015aed..be66ff3 100644
--- a/.github/workflows/lint-translate.yml
+++ b/.github/workflows/lint-translate.yml
@@ -14,15 +14,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install -w translate --include-workspace-root
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0aaa466..d13c89f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -28,15 +28,20 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: current
       - name: Run npm install
diff --git a/.github/workflows/nightly-static-build.yaml b/.github/workflows/nightly-static-build.yaml
index 64b1655..acde442 100644
--- a/.github/workflows/nightly-static-build.yaml
+++ b/.github/workflows/nightly-static-build.yaml
@@ -4,6 +4,9 @@ on:
   schedule:
     - cron: '0 0 * * *'
   workflow_dispatch:
+
+permissions: {}
+
 jobs:
   run-build:
     runs-on: ubuntu-latest
@@ -12,9 +15,11 @@ jobs:
       pull-requests: write # open or update the data PR and assign it
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: latest
       - name: Run npm install
@@ -30,7 +35,7 @@ jobs:
       - name: Format Output
         run: npm run lint:write -w static
       - name: Create or Update Pull Request
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           title: 'feat: update data'
           body: 'Updates the static data based on a nightly (or manual) run of the build step in GitHub Actions. Unless the data is invalid, this should be good to go.'
diff --git a/.github/workflows/publish-core.yml b/.github/workflows/publish-core.yml
deleted file mode 100644
index 694e4f3..0000000
--- a/.github/workflows/publish-core.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Publish core to npmjs.com
-
-on:
-  workflow_dispatch:
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v7
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 'latest'
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm install -w core
-      - run: npm run lint -w core
-      - run: npm run coverage -w core
-      - run: npm publish --provenance --access public -w core
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-fetchindex.yml b/.github/workflows/publish-fetchindex.yml
deleted file mode 100644
index 1c23374..0000000
--- a/.github/workflows/publish-fetchindex.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Publish @nodevu/fetchindex to npm
-
-on:
-  workflow_dispatch:
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v7
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 'latest'
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm install -w fetchindex
-      - run: npm run lint -w fetchindex
-      - run: npm run coverage -w fetchindex
-      - run: npm publish --provenance --access public -w fetchindex
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-newest.yml b/.github/workflows/publish-newest.yml
deleted file mode 100644
index 9b59beb..0000000
--- a/.github/workflows/publish-newest.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Publish @nodevu/newest to npmjs
-
-on:
-  workflow_dispatch:
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v7
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 'latest'
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm install -w newest
-      - run: npm run lint -w newest
-      - run: npm run coverage -w newest
-      - run: npm publish --provenance --access public -w newest
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/publish-static.yml b/.github/workflows/publish-static.yml
deleted file mode 100644
index 581578d..0000000
--- a/.github/workflows/publish-static.yml
+++ /dev/null
@@ -1,23 +0,0 @@
-name: Publish @nodevu/static to npmjs
-
-on:
-  workflow_dispatch:
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - uses: actions/checkout@v7
-      # Setup .npmrc file to publish to npm
-      - uses: actions/setup-node@v7
-        with:
-          node-version: 'latest'
-          registry-url: 'https://registry.npmjs.org'
-      - run: npm install -w static
-      - run: npm run lint -w static
-      - run: npm run coverage -w static
-      - run: npm publish --provenance --access public -w static
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/tests-core.yml b/.github/workflows/tests-core.yml
index 28537b0..4e19a02 100644
--- a/.github/workflows/tests-core.yml
+++ b/.github/workflows/tests-core.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -18,9 +21,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-fetchindex.yml b/.github/workflows/tests-fetchindex.yml
index 3fae39a..d208222 100644
--- a/.github/workflows/tests-fetchindex.yml
+++ b/.github/workflows/tests-fetchindex.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -18,9 +21,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-newest.yml b/.github/workflows/tests-newest.yml
index 36f0257..51affbe 100644
--- a/.github/workflows/tests-newest.yml
+++ b/.github/workflows/tests-newest.yml
@@ -10,6 +10,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -19,9 +22,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-oldest.yml b/.github/workflows/tests-oldest.yml
index 7395877..ad46d85 100644
--- a/.github/workflows/tests-oldest.yml
+++ b/.github/workflows/tests-oldest.yml
@@ -10,6 +10,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -19,9 +22,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-opt.yml b/.github/workflows/tests-opt.yml
index 3d8949f..a214937 100644
--- a/.github/workflows/tests-opt.yml
+++ b/.github/workflows/tests-opt.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -18,9 +21,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-parsefiles.yml b/.github/workflows/tests-parsefiles.yml
index b668c62..ed69ad0 100644
--- a/.github/workflows/tests-parsefiles.yml
+++ b/.github/workflows/tests-parsefiles.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -18,9 +21,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-ranges.yml b/.github/workflows/tests-ranges.yml
index bb43f5d..f57fe7d 100644
--- a/.github/workflows/tests-ranges.yml
+++ b/.github/workflows/tests-ranges.yml
@@ -11,6 +11,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -20,9 +23,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-static.yml b/.github/workflows/tests-static.yml
index 33c9fc0..5c0f1aa 100644
--- a/.github/workflows/tests-static.yml
+++ b/.github/workflows/tests-static.yml
@@ -9,6 +9,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -18,9 +21,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/tests-translate.yml b/.github/workflows/tests-translate.yml
index 1522acd..03ba7e7 100644
--- a/.github/workflows/tests-translate.yml
+++ b/.github/workflows/tests-translate.yml
@@ -12,6 +12,9 @@ on:
   workflow_dispatch:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     if: github.repository == 'cutenode/nodevu'
@@ -21,9 +24,11 @@ jobs:
         node-version: [current, lts/*, lts/-1]
     steps:
       - name: Checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install most recent npm
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..1e9b3d8
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,26 @@
+name: 'Linter: workflows'
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    paths:
+      - '.github/**'
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # upload findings to code scanning
+    steps:
+      - name: Checkout the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..c66ecaf
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,4 @@
+rules:
+  adhoc-packages:
+    # .npmrc sets package-lock=false, so every npm install is ad hoc by design
+    disable: true

From 9923bccd2f7a14cb9e2524ce5f3a028aee7e5391 Mon Sep 17 00:00:00 2001
From: botandbang <337765928+botandbang@users.noreply.github.com>
Date: Thu, 22 Oct 2026 12:11:57 -0400
Subject: [PATCH 2/2] ci: open the nightly and release PRs with a GitHub App
 token

Runs on a PR opened with GITHUB_TOKEN wait for manual approval, and
GitHub Actions can't create PRs at all with the repo's PR toggle off.
The nightly job and release.yml's pr job now mint a token from the app
in CI_APP_CLIENT_ID and CI_APP_PRIVATE_KEY, so their PRs get CI right
away, and their own GITHUB_TOKEN drops to read or nothing.
---
 .github/workflows/nightly-static-build.yaml | 14 ++++++++++++--
 .github/workflows/release.yml               | 15 +++++++++++----
 2 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/nightly-static-build.yaml b/.github/workflows/nightly-static-build.yaml
index acde442..7524118 100644
--- a/.github/workflows/nightly-static-build.yaml
+++ b/.github/workflows/nightly-static-build.yaml
@@ -11,8 +11,7 @@ jobs:
   run-build:
     runs-on: ubuntu-latest
     permissions:
-      contents: write # push the `nightly` branch
-      pull-requests: write # open or update the data PR and assign it
+      contents: read # the app token below pushes and opens the PR
     steps:
       - name: Checkout the repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -34,9 +33,20 @@ jobs:
         run: npm run build:support -w static
       - name: Format Output
         run: npm run lint:write -w static
+      # runs on a PR opened with GITHUB_TOKEN wait for someone to approve them;
+      # runs on an app token's PR start on their own
+      - name: Create a GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.CI_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
+          permission-contents: write # push the `nightly` branch
+          permission-pull-requests: write # open or update the data PR and assign it
       - name: Create or Update Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
+          token: ${{ steps.app-token.outputs.token }}
           title: 'feat: update data'
           body: 'Updates the static data based on a nightly (or manual) run of the build step in GitHub Actions. Unless the data is invalid, this should be good to go.'
           branch: 'nightly'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f785d4e..15550fb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,13 +18,20 @@ jobs:
   pr:
     if: github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
     runs-on: ubuntu-latest
-    permissions:
-      contents: write # push the `release/vX.Y.Z` branch and delete superseded ones
-      pull-requests: write # create a release PR, update its body, close superseded PRs
+    permissions: {} # uppt/pr does everything with the app token below
     steps:
+      # runs on a PR opened with GITHUB_TOKEN wait for someone to approve them;
+      # runs on an app token's PR start on their own
+      - id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.CI_APP_CLIENT_ID }}
+          private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
+          permission-contents: write # push the `release/vX.Y.Z` branch and delete superseded ones
+          permission-pull-requests: write # create a release PR, update its body, close superseded PRs
       - uses: danielroe/uppt/pr@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.app-token.outputs.token }}
           packages: |
             aliases
             core