ci: add zizmor and actionlint, harden workflows

.github/dependabot.yml

@@ -8,3 +8,5 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7

.github/workflows/actionlint.yml

@@ -0,0 +1,37 @@
+# This is deliberately a separate workflow -- so that it still runs when
+# another workflow file is broken.
+name: actionlint
+on:
+  push:
+    tags:
+      - v*
+    branches:
+      - main
+      - release-*
+  pull_request:
+
+# Cancel superseded runs of the same pull request. For everything else
+# (in particular, pushes to a branch or a tag) there is no PR number, so
+# the group falls back to the unique run_id and nothing is cancelled.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: kjanat/actionlint@722799fa4b8cc6734debb97bae24aca9e0dbaf59 # v1.17
+
+  all-done-actionlint:
+    needs:
+      - actionlint
+    runs-on: ubuntu-26.04
+    steps:
+    - run: echo "All jobs completed"

.github/workflows/test.yml

@@ -10,6 +10,13 @@ on:
   schedule:
     # Runs at 00:00 UTC every Monday
     - cron: '0 0 * * 1'
+# Cancel superseded runs of the same pull request. For everything else
+# (in particular, pushes to a branch or a tag) there is no PR number, so
+# the group falls back to the unique run_id and nothing is cancelled.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -28,8 +35,10 @@ jobs:
     runs-on: ubuntu-26.04
 
     steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-go@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: ${{ matrix.go-version }}
         go-version-file: go.mod # Take version from go.mod when go-version is empty.
@@ -40,12 +49,14 @@ jobs:
     timeout-minutes: 20
     runs-on: ubuntu-26.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
-    - uses: lima-vm/lima-actions/setup@v1
+    - uses: lima-vm/lima-actions/setup@55627e31b78637bf254a8b2a14da8ea7d12564e5 # v1.1.0
       id: lima-actions-setup
 
-    - uses: actions/cache@v6
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/lima
         key: lima-${{ steps.lima-actions-setup.outputs.version }}

.github/workflows/validate.yml

@@ -10,6 +10,13 @@ on:
   schedule:
     # Runs at 00:00 UTC every Monday
     - cron: '0 0 * * 1'
+# Cancel superseded runs of the same pull request. For everything else
+# (in particular, pushes to a branch or a tag) there is no PR number, so
+# the group falls back to the unique run_id and nothing is cancelled.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.run_id }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -18,17 +25,17 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: read
-      pull-requests: read
       checks: write # to allow the action to annotate code in the PR.
     runs-on: ubuntu-26.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
-      - uses: actions/setup-go@v7
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
-      - uses: golangci/golangci-lint-action@v9
+      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
       # Extra linters, only checking new code from a pull request.
       - name: lint-extra
         if: github.event_name == 'pull_request'
@@ -38,7 +45,9 @@ jobs:
   codespell:
     runs-on: ubuntu-26.04
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
     - name: install deps
       # Use a known version of codespell.
       run: pip install --break-system-packages codespell==v2.4.3
@@ -48,30 +57,47 @@ jobs:
   space-at-eol:
     runs-on: ubuntu-26.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - run: if git -P grep -I -n '\s$'; then echo "^^^ extra whitespace at EOL, please fix"; exit 1; fi
 
   deps:
     runs-on: ubuntu-26.04
     steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-go@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: stable
     - run: go mod tidy --diff
 
   govulncheck:
     runs-on: ubuntu-26.04
     steps:
-    - uses: golang/govulncheck-action@v1
+    - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
+
+  zizmor:
+    runs-on: ubuntu-26.04
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+    - uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+      with:
+        version: 1.31.1
+        advanced-security: false
+        annotations: true
 
-  all-done:
+  all-done-validate:
     needs:
       - codespell
       - deps
       - govulncheck
       - lint
       - space-at-eol
+      - zizmor
     runs-on: ubuntu-26.04
     steps:
     - run: echo "All jobs completed"

.github/zizmor.yml

@@ -0,0 +1,24 @@
+# Configuration for zizmor (https://docs.zizmor.sh/), run by the zizmor job
+# in .github/workflows/validate.yml.
+
+rules:
+  cache-poisoning:
+    # The audit fires because both workflows are also triggered by pushing a
+    # v* tag, so anything they cache is, in zizmor's view, a possible input to
+    # a release build. That does not hold here:
+    #
+    #  - This is a Go library, and no job in any workflow builds or publishes
+    #    release artifacts. A tag push merely runs the same tests and linters.
+    #
+    #  - GitHub scopes caches per branch: a pull request can read the default
+    #    branch's cache, but cannot write to it. So a pull request cannot plant
+    #    an entry that a later push or tag build would restore.
+    #
+    # The alternative (cache: false everywhere, lookup-only for the lima cache)
+    # makes every Go job re-download modules and start from a cold build cache,
+    # and every cgroup v1 job re-download the VM image, for no gain.
+    #
+    # Revisit this if a job ever starts publishing artifacts.
+    ignore:
+      - test.yml
+      - validate.yml