ci: reduce LTS automated release and add zizmor (#296)

* ci: monthly automated release of LTS
* ci: add zizmore scanning of actions
* ci: add Dependabot cooldown
* fix: include updated format-yaml-files.sh script

Signed-off-by: Patrick Stephens <pat@telemetryforge.io>

Author: patrick-stephens

.github/dependabot.yml

@@ -1,13 +1,15 @@
 version: 2
 updates:
-  - package-ecosystem: github-actions
-    directory: /
+  - package-ecosystem: "github-actions"
+    directory: "/"
     groups:
       github-actions:
         patterns:
           - "*"
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "docker"
     directory: "/"
@@ -17,3 +19,5 @@ updates:
           - "*"
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7

.github/workflows/cron-auto-release.yaml

@@ -2,11 +2,11 @@ name: Tag a new release
 on:
   schedule:
     # 25.10 releases
-    - cron: "0 10 * * 1"
+    - cron: "0 14 1 * *"
     # 26.4 releases
-    - cron: "0 14 * * 1"
+    - cron: "0 14 15 * *"
     # Latest releases
-    - cron: "0 10 * * 2"
+    - cron: "0 10 * * 1"
   workflow_dispatch:
     inputs:
       branch:
@@ -50,21 +50,21 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: 25.10 run
-        if: github.event_name == 'schedule' && github.event.schedule=='0 10 * * 1'
+        if: github.event_name == 'schedule' && github.event.schedule=='0 14 1 * *'
         run: |
           echo "BRANCH=release/25.10-lts" >> $GITHUB_ENV
           echo "TAG_PREFIX=v25.10*" >> $GITHUB_ENV
         shell: bash
 
       - name: 26.4 run
-        if: github.event_name == 'schedule' && github.event.schedule=='0 14 * * 1'
+        if: github.event_name == 'schedule' && github.event.schedule=='0 14 15 * *'
         run: |
           echo "BRANCH=release/26.4-lts" >> $GITHUB_ENV
           echo "TAG_PREFIX=v26.4*" >> $GITHUB_ENV
         shell: bash
 
       - name: main run
-        if: github.event_name == 'schedule' && github.event.schedule=='0 10 * * 2'
+        if: github.event_name == 'schedule' && github.event.schedule=='0 10 * * 1'
         run: |
           echo "BRANCH=main" >> $GITHUB_ENV
           echo "TAG_PREFIX=v*" >> $GITHUB_ENV

.github/workflows/lint.yaml

@@ -28,6 +28,8 @@ jobs:
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
         # Ignores do not work: https://github.com/reviewdog/action-hadolint/issues/35 is resolved
       - uses: reviewdog/action-hadolint@921946a7ebaaf08ac72607bad67209f4e52b5407 # v1.50.5
 
@@ -44,6 +46,8 @@ jobs:
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: reviewdog/action-shellcheck@4c07458293ac342d477251099501a718ae5ef86e # v1.32.0
         with:
           reporter: github-pr-review
@@ -65,6 +69,8 @@ jobs:
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - run: |
           echo "::add-matcher::.github/actionlint-matcher.json"
           bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
@@ -80,6 +86,8 @@ jobs:
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - run: ./scripts/format-yaml-files.sh
         shell: bash
 
@@ -141,7 +149,37 @@ jobs:
         with:
           egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: suzuki-shunsuke/pinact-action@cf51507d80d4d6522a07348e3d58790290eaf0b6 # v2.0.0
         with:
           skip_push: "true"
           review: "true"
+
+  zizmor-lint:
+    runs-on: ubuntu-latest
+    name: PR - Zizmor
+    # https://docs.zizmor.sh/
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      # contents: read         # Only needed for private repos. Needed to clone the repo.
+      # actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Harden the runner
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
+        with:
+          egress-policy: ${{ env.STEP_SECURITY_EGRESS_POLICY }}
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          # We only want to scan our workflows, no other included source
+          input: |
+            ".github/"
+          # Upload to security tab in GitHub, requires permissions: security-events: write
+          # Note this does not fail the workflow, just uploads the results to the security tab in GitHub
+          advanced-security: true
+          min-severity: "medium"

README.md

@@ -27,7 +27,8 @@ It also has built-in functionality for:
 
 | Version | Release Date | Type | End of Support | Status | Branch |
 | ------- | ------------ | ---- | -------------- | ------ | ------ |
-| **[26.10](https://github.com/orgs/telemetryforge/projects/5)** | Oct 2026 | LTS | Oct 2028 | 🟡 Planned | `main` |
+| **[27.4](https://github.com/orgs/telemetryforge/projects/6)** | Apr 2027 | LTS | Apr 2029 | 🟡 Planned | `main` |
+| **[26.10](https://github.com/orgs/telemetryforge/projects/5)** | Oct 2026 | LTS | Oct 2028 | 🟢 Active | `main` |
 | **[26.4](https://github.com/orgs/telemetryforge/projects/4)** | Apr 2026 | LTS | Apr 2028 | 🟢 Active | `release/26.4-lts` |
 | **[25.10](https://github.com/orgs/telemetryforge/projects/3)** | Oct 2025 | LTS | Oct 2027 | 🟢 Active | `release/25.10-lts` |
 | 25.07 | Jul 2025 | Regular | Jan 2026 | 🔴 EOL | |
@@ -41,7 +42,7 @@ Once it transitions to an LTS release then we maintain the major and minor versi
 | ------------ | --------- | ----------- |
 | **LTS Release** | Twice yearly (April, October) | Long-term support for 24 months |
 | **Regular Release** | Quarterly | 6-month support cycle |
-| **Security Updates** | Weekly | CVE patches and critical fixes |
+| **Security Updates** | Monthly or as needed | CVE patches and critical fixes |
 | **Patch Release** | As needed | Bug fixes and minor updates |
 | **Main Builds** | Weekly | Latest development builds from main branch |
 

scripts/format-yaml-files.sh

@@ -19,23 +19,26 @@ REPO_ROOT=${REPO_ROOT:-${SCRIPT_DIR}/..}
 
 YAML_DIR=${YAML_DIR:-$REPO_ROOT/.github/workflows}
 
-# Check if prettier is installed, if not install it globally
-if ! command -v prettier &> /dev/null
-then
-    echo "prettier could not be found, installing it globally..."
-    sudo npm install -g prettier
+if command -v prettier &> /dev/null; then
+    PRETTIER_CMD=(prettier)
+elif command -v npx &> /dev/null; then
+    PRETTIER_CMD=(npx --yes prettier)
+else
+    echo "prettier is not available and npx is not installed."
+    echo "Please install prettier or npm/npx."
+    exit 1
 fi
 
 # Format all yaml files in the directory
-find "$YAML_DIR" -name "*.yaml" -o -name "*.yml" | while read -r file; do
+find "$YAML_DIR" -type f \( -name "*.yaml" -o -name "*.yml" \) | while read -r file; do
     echo "Formatting $file"
-    prettier --write "$file"
+    "${PRETTIER_CMD[@]}" --write "$file"
 done
 
 # Check if there are any changes after formatting
-if [[ -n $(git status --porcelain) ]]; then
+if [[ -n $(git -C "$REPO_ROOT" status --porcelain -- "$YAML_DIR") ]]; then
     echo "The following files were modified after formatting:"
-    git status --porcelain
+    git -C "$REPO_ROOT" status --porcelain -- "$YAML_DIR"
     echo "Please review the changes and commit them."
     exit 1
 else

zizmor.yml

@@ -0,0 +1 @@
+rules: