ci: address zizmor findings across workflows (#1009)

* ci: harden dependabot-approve actor check and pin lunariajs/action

Two findings from a zizmor (static analysis for GitHub Actions) sweep:

- dependabot-approve: github.actor is spoofable. A PR whose HEAD commit
  author is dependabot[bot] would pass this check even if the PR was
  opened by another account (the Synacktiv Dependabot bypass). Use
  github.event.pull_request.user.login, which is the PR opener and
  cannot be spoofed. https://docs.zizmor.sh/audits/#bot-conditions

- lunaria: lunariajs/action was pinned to the mutable v1-prerelease
  branch tag. Every other action in the repo is SHA-pinned. Pin to the
  current branch tip with the v1-prerelease tag in a trailing comment
  so dependabot can keep it updated.

* ci: address remaining zizmor medium findings

Sweep of the remaining zizmor medium findings:

artipacked (persist-credentials):
- lunaria: was missing it. Workflow is read-only -- now persist-credentials: false.
- sync-templates: was using the default. Sync step uses the app token via GH_TOKEN, not the persisted git credential -- persist-credentials: false.
- auto-extract, auto-format (same-repo), format-command (same-repo), query-counts-apply (same-repo), release: persistence is intentional (each pushes back using the app token). Make it explicit with persist-credentials: true and a one-line comment so zizmor stops flagging and reviewers see the why.

excessive-permissions (release.yml):
- Add workflow-level permissions: {} so the sync-templates call doesn't fall through to default repo permissions. The release job already declares its own scoped block; the called workflow's job-level permissions still take precedence.

secrets-inherit (release.yml -> sync-templates.yml):
- Replace secrets: inherit with an explicit secrets: { APP_ID, APP_PRIVATE_KEY } mapping. sync-templates declares them as required on its workflow_call: trigger.

After this commit + the upstream changes already in this PR, zizmor
reports 0 high / 0 medium findings on the workflows that aren't gated
behind the zizmor.yml config (which will land in a follow-up PR).
The remaining findings are dangerous-triggers on the six workflows
that use pull_request_target / workflow_run defensively, plus
excessive-permissions on cla.yml -- all known and accepted.

Author: ascorbic

.github/workflows/auto-extract.yml

@@ -28,6 +28,9 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
+          # Intentional: the "Commit and push" step below pushes the
+          # extracted catalogs back to main using this credential.
+          persist-credentials: true
 
       - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
 

.github/workflows/auto-format.yml

@@ -45,6 +45,9 @@ jobs:
         with:
           ref: ${{ steps.pr.outputs.ref }}
           token: ${{ steps.app-token.outputs.token }}
+          # Intentional: the same-repo push step below pushes the
+          # formatted changes back to the PR branch using this credential.
+          persist-credentials: true
 
       # --- Fork PRs: checkout the fork at the pinned SHA ---
 

.github/workflows/dependabot-approve.yml

@@ -11,7 +11,12 @@ permissions:
 jobs:
   approve:
     name: Auto-Approve
-    if: github.actor == 'dependabot[bot]'
+    # Use github.event.pull_request.user.login, not github.actor.
+    # github.actor reflects the last actor on the trigger and is spoofable
+    # via a PR whose HEAD commit author is 'dependabot[bot]'. The
+    # pull_request.user.login is the PR opener and cannot be spoofed.
+    # https://docs.zizmor.sh/audits/#bot-conditions
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:

.github/workflows/format-command.yml

@@ -63,6 +63,9 @@ jobs:
         with:
           ref: ${{ steps.pr.outputs.ref }}
           token: ${{ steps.app-token.outputs.token }}
+          # Intentional: the same-repo push step below pushes the
+          # formatted changes back to the PR branch using this credential.
+          persist-credentials: true
 
       - name: Checkout (fork)
         if: steps.pr.outputs.is_fork == 'true'

.github/workflows/lunaria.yml

@@ -20,10 +20,11 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - uses: lunariajs/action@v1-prerelease
+      - uses: lunariajs/action@a0594f1c5b8d55fb367d8df607d5e2541c99e77d # v1-prerelease

.github/workflows/query-counts-apply.yml

@@ -139,6 +139,9 @@ jobs:
         with:
           ref: ${{ steps.pr.outputs.sha }}
           token: ${{ steps.app-token.outputs.token }}
+          # Intentional: the same-repo push step below pushes the
+          # updated snapshots back to the PR branch using this credential.
+          persist-credentials: true
 
       # --- Fork PRs: checkout the fork at the pinned SHA so we can push back ---
 

.github/workflows/release.yml

@@ -13,6 +13,13 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+# Default-deny at the workflow level. Each job scopes its own permissions:
+# - `release` declares contents/id-token/pull-requests below.
+# - `sync-templates` calls a reusable workflow whose own job-level
+#   permissions block (contents: read) takes precedence over the caller's
+#   inherited permissions.
+permissions: {}
+
 jobs:
   release:
     name: Release
@@ -36,6 +43,9 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
+          # Intentional: changesets/action pushes the release PR / tags
+          # using this credential.
+          persist-credentials: true
 
       - name: Setup pnpm
         uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
@@ -79,4 +89,8 @@ jobs:
       needs.release.outputs.published == 'true' ||
       inputs.publish-only
     uses: ./.github/workflows/sync-templates.yml
-    secrets: inherit
+    # Pass only the secrets sync-templates actually uses, not the full set
+    # available to this release workflow.
+    secrets:
+      APP_ID: ${{ secrets.APP_ID }}
+      APP_PRIVATE_KEY: ${{ secrets.APP_PRIVATE_KEY }}

.github/workflows/sync-templates.yml

@@ -3,6 +3,13 @@ name: Sync Templates
 on:
   workflow_dispatch:
   workflow_call:
+    secrets:
+      APP_ID:
+        required: true
+        description: GitHub App client ID for emdashbot.
+      APP_PRIVATE_KEY:
+        required: true
+        description: GitHub App private key for emdashbot.
 
 jobs:
   sync:
@@ -23,6 +30,10 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          # Read-only: the sync step uses the app token via GH_TOKEN, not
+          # the persisted git credential.
+          persist-credentials: false
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0