Add actionci.yml (#91)

* Add actionci.yml

Add caller workflow for actionci (actionlint + zizmor + frizbee).
Add permissions blocks and zizmor suppression config.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Suppress dependabot-cooldown in zizmor config

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Fix zizmor errors: pin actions, fix bot-conditions, deduplicate permissions

- Pin unpinned actions to SHA digests via frizbee
- Fix spoofable bot actor checks (github.actor → github.event.pull_request.user.login)
- Remove duplicate permissions blocks
- Suppress low-confidence cache-poisoning findings
- Pin postgres container image

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Add permissions to triage.yml to fix zizmor excessive-permissions warning

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: tashian

.github/workflows/actionci.yml

@@ -0,0 +1,22 @@
+name: Action CI
+
+on:
+  push:
+    tags-ignore:
+    - 'v*'
+    branches:
+    - "master"
+  pull_request:
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  actionci:
+    permissions:
+      contents: read
+      security-events: write
+    uses: smallstep/workflows/.github/workflows/actionci.yml@main
+    secrets: inherit

.github/workflows/ci.yml

@@ -9,8 +9,15 @@ on:
   pull_request:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   ci:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     uses: smallstep/workflows/.github/workflows/goCI.yml@main
     with:
       only-latest-golang: false
@@ -22,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     services:
       postgres:
-        image: postgres
+        image: postgres:17
         env:
           POSTGRES_USER: user
           POSTGRES_PASSWORD: password

.github/workflows/code-scan-cron.yml

@@ -2,6 +2,11 @@ on:
   schedule:
     - cron: '0 0 * * SUN'
 
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
 jobs:
   code-scan:
     uses: smallstep/workflows/.github/workflows/code-scan.yml@main

.github/workflows/dependabot-auto-merge.yml

@@ -8,11 +8,11 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2.5.0
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Enable auto-merge for Dependabot PRs

.github/workflows/triage.yml

@@ -8,22 +8,34 @@ on:
     types:
       - opened
 
+permissions:
+  contents: read
+  issues: write
+  pull-requests: write
+
 jobs:
 
   label:
     name: Label PR
+    permissions:
+      contents: read
+      pull-requests: write
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request_target'
     steps:
-    - uses: actions/labeler@v6.0.1
+    - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
       with:
         repo-token: "${{ secrets.GITHUB_TOKEN }}"
 
   add-to-project:
     name: Add to Triage Project
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.2
+      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
         with:
           project-url: https://github.com/orgs/smallstep/projects/94
           github-token: ${{ secrets.TRIAGE_PAT }}

.github/zizmor.yml

@@ -0,0 +1,16 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "smallstep/*": ref-pin
+  secrets-inherit:
+    disable: true
+  ref-confusion:
+    disable: true
+  dangerous-triggers:
+    ignore:
+      - triage.yml
+  cache-poisoning:
+    disable: true
+  dependabot-cooldown:
+    disable: true