From c2579a53ded44aaf7487397e74a9d35d6e8f4b52 Mon Sep 17 00:00:00 2001
From: Dan Shernicoff <dshernicoff@tenable.com>
Date: Wed, 14 Oct 2026 10:29:51 -0400
Subject: [PATCH 1/2] Ignore the unpinned `teahouse-hosting/upload`

Per our hosting provider we should be using `trunk` since it is being
actively worked on. This will be pinned when we are instructed that it
can be.
---
 .github/workflows/main.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index e694656..987d134 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -7,7 +7,6 @@ on:
   repository_dispatch:
 
 permissions:
-  id-token: write # This is required for requesting the JWT
   contents: read # This is required for actions/checkout
 
 concurrency:
@@ -38,6 +37,8 @@ jobs:
       url: https://render-engine.org
     runs-on: ubuntu-latest
     needs: build
+    permissions:
+      id-token: write # This is required for requesting the JWT
     if: github.ref == 'refs/heads/main'
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -45,7 +46,7 @@ jobs:
           name: website
           path: ./output
       - name: Upload
-        uses: teahouse-hosting/upload@trunk
+        uses: teahouse-hosting/upload@trunk # zizmor: ignore[unpinned-uses]
         with:
           domain: render-engine.org
           root: ./output/

From 7bfe80c9c592108b3600f6b8c94295a20166bde2 Mon Sep 17 00:00:00 2001
From: Dan Shernicoff <dshernicoff@tenable.com>
Date: Wed, 14 Oct 2026 10:30:24 -0400
Subject: [PATCH 2/2] Add `zizmor` workflow

Help us ensure that our actions are as secure as we can make them.
---
 .github/workflows/zizmor.yml | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..828da04
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read         # Only needed for private repos. Needed to clone the repo.
+      actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4