ci: harden actions and add linter (withastro#13917)

Co-authored-by: Armand Philippot <git@armand.philippot.eu>

Author: ematipico

.github/workflows/ci.yml

@@ -11,6 +11,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 env:
   NODE_OPTIONS: "--max_old_space_size=8192"
 

.github/workflows/contributors.yml

@@ -5,6 +5,8 @@ on:
     - cron:  '0 3 * * SUN'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   contributors:
     name: docs_contributors

.github/workflows/discord-congrats.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches: [main]
 
+permissions: {}
+
 jobs:
   congrats:
     name: congratsbot

.github/workflows/discord-i18n-ping.yml

@@ -5,6 +5,8 @@ on:
     - cron:  '0 10 * * TUE'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   translation:
     name: translation_tuesday

.github/workflows/format.yml

@@ -5,6 +5,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   format:
     runs-on: ubuntu-latest

.github/workflows/lint-ja-docs.yml

@@ -11,6 +11,8 @@ on:
       - 'src/content/docs/ja/**'
       - '.textlintrc.ja.json'
 
+permissions: {}
+
 # Automatically cancel in-progress actions on the same branch
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name == 'pull_request_target' && github.head_ref || github.ref }}

.github/workflows/lunaria.yml

@@ -2,6 +2,7 @@ name: Lunaria
 
 on:
   # Trigger the workflow every time a pull request is opened or synchronized at the target `main` branch
+  # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types: [opened, synchronize]
 

.github/workflows/nightly.yml

@@ -5,6 +5,8 @@ on:
       - cron:  '0 12 * * *'
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   docgen:
     name: Generate Reference Docs

.github/workflows/welcome-bot.yml

@@ -1,17 +1,19 @@
 name: WelcomeBot
 
 on:
+  # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     branches: [main]
     types: [opened]
 
-permissions:
-  pull-requests: write
+permissions: {}
 
 jobs:
   welcome:
     name: Welcome First Time Contributors
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: zephyrproject-rtos/action-first-interaction@58853996b1ac504b8e0f6964301f369d2bb22e5c

.github/workflows/zizmor.yml

@@ -0,0 +1,30 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read         # Only needed for private repos. Needed to clone the repo.
+      actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          inputs: '.github/workflows/'
+          min-confidence: medium
+          min-severity: medium