ci: harden GitHub Actions security posture

.github/workflows/deploy.yaml

@@ -8,26 +8,25 @@ on:
 
 permissions:
   contents: read
-  id-token: write
-  deployments: write
-  pull-requests: write
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout your repository using git
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
       - name: Install tools with mise
-        uses: jdx/mise-action@v4
+        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4
       - name: Enable corepack
         run: corepack enable
       - name: Install dependencies
         run: pnpm install
       - name: Build site
         run: pnpm run build
       - name: Upload dist artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: dist
           path: dist/
@@ -36,15 +35,20 @@ jobs:
     needs: build
     if: github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]')
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     environment:
       name: cloudflare
       url: ${{ steps.cf-url.outputs.value }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
 
       - name: Install tools with mise
-        uses: jdx/mise-action@v4
+        uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4
         with:
           install_args: node
 
@@ -55,7 +59,7 @@ jobs:
         run: pnpm install --frozen-lockfile
 
       - name: Download dist artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:
           name: dist
           path: dist/

.github/zizmor.yml

@@ -0,0 +1,14 @@
+# zizmor configuration
+#
+# https://docs.zizmor.sh/configuration/
+
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # The org's shared reusable workflows are trusted via the
+        # `verified-actions` branch, which is protected and reviewed.
+        # Pin to that branch rather than a hash so updates land
+        # automatically when the branch is fast-forwarded.
+        "chinmina/.github/*": ref-pin
+        "*": hash-pin