fix(ci): install Zig from a pinned, verified tarball — replaces non-allow-listed mlugg/setup-zig (#103)

[hyperpolymath]

Summary

Owner ruling 2026-09-30: swap the Zig setup action instead of changing the allow-list. Part of #103, item 1.

ABI Contract and Cross-Platform Build & Test ended in startup_failure on main and on every PR. Their run pages (35609965294, 35609970129) give this cause:

The action mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 is not allowed in hyperpolymath/game-server-admin because all actions must be from a repository owned by hyperpolymath, created by GitHub, or verified in the GitHub Marketplace.

Repo Actions policy: allowed_actions=selected, github_owned_allowed=true, verified_allowed=true, patterns_allowed=[], sha_pinning_required=true. None of the Zig installers is GitHub-owned or from a verified creator (mlugg/setup-zig, goto-bus-stop/setup-zig, korandoru/setup-zig), so no allow-listed action can do this.

Change

• New scripts/install-zig.sh (MPL-2.0, mode 100755). It downloads zig-x86_64-linux-0.15.2.tar.xz from ziglang.org over HTTPS.
  • It checks the download against the pinned sha256 02aa270f…f93239, then puts Zig on PATH via $GITHUB_PATH.
  • It checks that zig version prints 0.15.2.
  • It fails loudly on any platform other than x86_64-linux.
  • At pin time, the tarball's minisign signature was verified against the ZSF key RWSGOq2NVecA2UPN…. Both the file signature and the trusted-comment signature passed, and a tampered digest was rejected.
• abi-contract.yml (2 sites) and cross-platform.yml (1 site): uses: mlugg/setup-zig → run: bash scripts/install-zig.sh. The idris2-pack container job now also installs curl ca-certificates.
• actions.lock, edited by hand; the gh actions-lock rewrite mode was not used. Three mlugg/setup-zig@v2.2.1 entries were removed: two workflow lists and one dependency. gh actions-lock --no-fix reports valid: true.
• docs/maintainer/CI-CD-GUIDE.adoc: updated to describe how Zig is now installed.

Validation

• actionlint on both workflows: clean. shellcheck and bash -n on the script: clean.
• The script ran locally: sha256 OK, and zig 0.15.2 was installed.
• Mutant check: with a one-character change to the pinned sha256, the script exits 1 and does not write GITHUB_PATH.

Not in this PR

These #103 items are left for follow-up: the Governance, Pages and Mirror startup failures, the K9 pedigree name error, and the SonarCloud and Hypatia reds.

🤖 Generated with Claude Code

https://claude.ai/code/session_0136eszqrQ53Kj7aBH1D4rXK

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 33 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 405ac4d7-47d4-4c2e-a366-23c2b0737b25

📥 Commits

Reviewing files that changed from the base of the PR and between 070529e and fbd8151.

⛔ Files ignored due to path filters (1)

• .github/workflows/actions.lock is excluded by !**/*.lock

📒 Files selected for processing (4)

• .github/workflows/abi-contract.yml
• .github/workflows/cross-platform.yml
• docs/maintainer/CI-CD-GUIDE.adoc
• scripts/install-zig.sh

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 Hypatia Security Scan

Findings: 90 issues detected

Severity	Count
🔴 Critical	0
🟠 High	1
🟡 Medium	89

View findings

[
  {
    "reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "label-triage.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "triage"
  },
  {
    "reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
    "type": "missing_timeout_minutes",
    "file": "labels.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium",
    "recipe_id": "recipe-add-workflow-timeout-minutes",
    "job": "sync"
  },
  {
    "line": 39,
    "reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/labels.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 45,
    "reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/push-email-notify.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 120,
    "reason": "job in .github/workflows/release.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/release.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 25,
    "reason": "job in .github/workflows/instant-sync.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/instant-sync.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 84,
    "reason": "job in .github/workflows/hypatia-scan.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/hypatia-scan.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 24,
    "reason": "job in .github/workflows/boj-build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/boj-build.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 53,
    "reason": "job in .github/workflows/label-triage.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
    "type": "RE001",
    "file": ".github/workflows/label-triage.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  },
  {
    "line": 87,
    "reason": "workflow .github/workflows/static-analysis-gate.yml:87 step `Emit check annotations` swallows non-zero exit via `|| true` — failures will be masked",
    "type": "RE005",
    "file": ".github/workflows/static-analysis-gate.yml",
    "action": "report",
    "rule_module": "research_extensions",
    "severity": "warn"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence