From 9f7d33819c844d3737949aeef12cca368fd99c50 Mon Sep 17 00:00:00 2001
From: Thomas de Meyer <demeyerthom@users.noreply.github.com>
Date: Tue, 28 Apr 2026 14:55:36 +0200
Subject: [PATCH 1/2] Add pinact and zizmor workflow checks

---
 .github/workflows/pinact.yaml | 32 ++++++++++++++++++++++++++++++++
 .github/workflows/release.yml | 16 ++++++++--------
 .github/workflows/zizmor.yaml | 32 ++++++++++++++++++++++++++++++++
 3 files changed, 72 insertions(+), 8 deletions(-)
 create mode 100644 .github/workflows/pinact.yaml
 create mode 100644 .github/workflows/zizmor.yaml

diff --git a/.github/workflows/pinact.yaml b/.github/workflows/pinact.yaml
new file mode 100644
index 0000000..2ae23a3
--- /dev/null
+++ b/.github/workflows/pinact.yaml
@@ -0,0 +1,32 @@
+name: Pinact
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+
+permissions: {}
+
+jobs:
+  pinact:
+    # Only run on pull requests from the same repository
+    if: github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Pin actions
+        uses: suzuki-shunsuke/pinact-action@cf51507d80d4d6522a07348e3d58790290eaf0b6 # v2.0.0
+        with:
+          skip_push: true
+          verify: true
+          min_age: 7
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 482ff91..e5ef6b6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -10,14 +10,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 24
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@eae0cfeb286e66ffb5155f1a79b90583a127a68b # v2.4.1
         name: Install pnpm
         id: pnpm-install
         with:
@@ -45,16 +45,16 @@ jobs:
     needs: lint-test-build
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
         with:
           fetch-depth: 0
 
       - name: Install node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 24
 
-      - uses: pnpm/action-setup@v2
+      - uses: pnpm/action-setup@eae0cfeb286e66ffb5155f1a79b90583a127a68b # v2.4.1
         name: Install pnpm
         id: pnpm-install
         with:
@@ -66,7 +66,7 @@ jobs:
         shell: bash
         run: echo "STORE_PATH=$(pnpm store path)" >> $GITHUB_OUTPUT
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
         name: Setup pnpm cache
         with:
           path: ${{ steps.pnpm-cache.outputs.STORE_PATH }}
@@ -78,7 +78,7 @@ jobs:
         run: npm i -g npm@^11.11.0
 
       - name: Create and publish versions
-        uses: changesets/action@v1
+        uses: changesets/action@6a0a831ff30acef54f2c6aa1cbbc1096b066edaf # v1.7.0
         with:
           title: 'Release new version'
           commit: 'update version'
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
new file mode 100644
index 0000000..8e6493b
--- /dev/null
+++ b/.github/workflows/zizmor.yaml
@@ -0,0 +1,32 @@
+name: Zizmor
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+    paths:
+      - ".github/workflows/**"
+      - ".github/actions/**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        with:
+          advanced-security: false
+          annotations: true
+          min-severity: high

From 68df57333cc6e441c32691117aa64712a191cf36 Mon Sep 17 00:00:00 2001
From: Thomas de Meyer <demeyerthom@users.noreply.github.com>
Date: Tue, 28 Apr 2026 14:57:17 +0200
Subject: [PATCH 2/2] Format workflow files with prettier

---
 .github/workflows/pinact.yaml | 8 ++++----
 .github/workflows/zizmor.yaml | 8 ++++----
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/pinact.yaml b/.github/workflows/pinact.yaml
index 2ae23a3..d79259e 100644
--- a/.github/workflows/pinact.yaml
+++ b/.github/workflows/pinact.yaml
@@ -2,12 +2,12 @@ name: Pinact
 
 on:
   push:
-    branches: ["main"]
+    branches: ['main']
   pull_request:
-    branches: ["**"]
+    branches: ['**']
     paths:
-      - ".github/workflows/**"
-      - ".github/actions/**"
+      - '.github/workflows/**'
+      - '.github/actions/**'
 
 permissions: {}
 
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 8e6493b..496babc 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -2,12 +2,12 @@ name: Zizmor
 
 on:
   push:
-    branches: ["main"]
+    branches: ['main']
   pull_request:
-    branches: ["**"]
+    branches: ['**']
     paths:
-      - ".github/workflows/**"
-      - ".github/actions/**"
+      - '.github/workflows/**'
+      - '.github/actions/**'
 
 permissions: {}