From 2e6fa057c8dd79dd8c7f528a010dec41c1b9e38e Mon Sep 17 00:00:00 2001
From: Boshen <boshenc@gmail.com>
Date: Thu, 7 May 2026 13:54:57 +0800
Subject: [PATCH] chore(ci): harden workflows + add zizmor security analysis

- Add Security Analysis workflow running oxc-project/security-action
- Set persist-credentials: false on all actions/checkout steps
- Add top-level permissions: {} and least-privilege per-job permissions
- Drop pnpm cache from publish.yml setup-node and ignore residual zizmor cache-poisoning warnings (mitigated by --frozen-lockfile + provenance)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .github/workflows/ci.yml                  | 10 ++++++++++
 .github/workflows/deploy-docs-staging.yml |  6 ++++++
 .github/workflows/deploy-docs.yml         |  6 ++++++
 .github/workflows/publish.yml             | 11 ++++++++---
 .github/workflows/security.yml            | 24 +++++++++++++++++++++++
 5 files changed, 54 insertions(+), 3 deletions(-)
 create mode 100644 .github/workflows/security.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 05b631ead..99ff7cf71 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,11 +13,17 @@ on:
         required: false
         default: false
 
+permissions: {}
+
 jobs:
   lint-and-check:
     runs-on: blacksmith-4vcpu-ubuntu-2404
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@26f6d4f2c533a43e6b5da0b4a5dd983f98f7b49a # v6.0.4
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
@@ -30,6 +36,8 @@ jobs:
 
   test:
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -55,6 +63,8 @@ jobs:
             prebuild: playground/svelte-pages playground/solid-pages
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@26f6d4f2c533a43e6b5da0b4a5dd983f98f7b49a # v6.0.4
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
diff --git a/.github/workflows/deploy-docs-staging.yml b/.github/workflows/deploy-docs-staging.yml
index 2ce5cfc4b..cde58e7b4 100644
--- a/.github/workflows/deploy-docs-staging.yml
+++ b/.github/workflows/deploy-docs-staging.yml
@@ -7,12 +7,18 @@ on:
   # paths:
   # - docs/**
 
+permissions: {}
+
 jobs:
   deploy:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     environment: Docs
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@26f6d4f2c533a43e6b5da0b4a5dd983f98f7b49a # v6.0.4
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index a23df51d8..11477d2b0 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -7,12 +7,18 @@ on:
     paths:
       - docs/**
 
+permissions: {}
+
 jobs:
   deploy:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     environment: Docs
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@26f6d4f2c533a43e6b5da0b4a5dd983f98f7b49a # v6.0.4
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ecd70d41c..364d6cac3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,9 +5,13 @@ on:
     tags:
       - 'v*'
 
+permissions: {}
+
 jobs:
   ci:
     uses: ./.github/workflows/ci.yml
+    permissions:
+      contents: read
     with:
       skip_windows: true
 
@@ -19,18 +23,19 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: pnpm/action-setup@26f6d4f2c533a43e6b5da0b4a5dd983f98f7b49a # v6.0.4
       - run: echo "NODE_AUTH_TOKEN=${{ secrets.NPM_TOKEN }}" >> "$GITHUB_ENV"
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 # zizmor: ignore[cache-poisoning]
         with:
           node-version-file: .node-version
-          cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm build
 
       # Configure the publish registry after install so docs dependencies under
       # @voidzero-dev continue to resolve from npm during installation.
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0 # zizmor: ignore[cache-poisoning]
         with:
           node-version-file: .node-version
           registry-url: https://registry.npmjs.org
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 000000000..175e69bf1
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,24 @@
+name: Security Analysis
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [opened, synchronize]
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/**'
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.ref_name != 'main' }}
+
+jobs:
+  security:
+    name: Security Analysis
+    runs-on: ubuntu-latest
+    steps:
+      - uses: oxc-project/security-action@781317603d045c3eafc99daef653fcac77e12aa8 # v1.0.3