ci: harden GitHub Actions workflows#20

Merged

flavorjones merged 6 commits intomainfrom

harden-github-actions

Mar 20, 2026

Commits on Mar 20, 2026

Add GitHub Actions audit CI job (actionlint + zizmor)

flavorjones
and
claude
committed
Configure dependabot for github-actions and gomod with batching and cooldowns

flavorjones
and
claude
committed
Add lint-actions Makefile target for local actionlint and zizmor

flavorjones
and
claude
committed
Pin GitHub Actions to SHA hashes via pinact

flavorjones
and
claude
committed
Fix excessive-permissions and suppress cache-poisoning findings

flavorjones
and
claude
committed
Fix artipacked: add persist-credentials: false to checkout steps

flavorjones
and
claude
committed