security: harden supply chain dependencies

[urugus]

Summary

• インストールスクリプト（Homebrew、Brewfile、フォント）の curl | bash パターンをコミット固定＋SHA256チェックサム検証に置換
• GitHub Actions の全サードパーティアクションをフルコミットハッシュにピン留め（CI内バイナリDLにもチェックサム追加）
• Zinit 本体・全プラグインをコミットハッシュ固定、lazy.nvim ブートストラップを --branch=stable → 特定コミットに変更
• yaskkserv2 の cargo install --git に --tag 0.1.7 を追加

Motivation

サプライチェーン攻撃リスク分析の結果、外部依存のバージョン未固定・チェックサム未検証が複数箇所で確認されたため対策を実施。

Test plan

• ./install_scripts/dotinstaller.sh link でリンク確認
• nvim --headless "+Lazy sync" +qa でプラグイン同期確認
• GitHub Actions の各ワークフローが正常に動作することを確認
• 新規環境で ./setup.sh --install を実行し、チェックサム検証が機能することを確認

[Copilot]

Pull request overview

This PR hardens the dotfiles’ supply chain by pinning external dependencies (install scripts, GitHub Actions, and shell/editor plugins) to immutable references and adding checksum verification before executing downloaded artifacts.

Changes:

• Replace curl | bash-style installs with commit/tag pinning plus SHA-256 verification for Homebrew/Brewfile/font downloads.
• Pin GitHub Actions usages to full commit SHAs and add checksum verification for downloaded CI binaries.
• Pin zsh/neovim plugin bootstraps to fixed revisions (zinit plugins via ver"<sha>", lazy.nvim via commit checkout, yaskkserv2 via --tag).

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 9 comments.

Show a summary per file

File	Description
install_scripts/lib/dotinstaller/install-skk.sh	Pin yaskkserv2 install to a release tag.
install_scripts/lib/dotinstaller/install-homebrew.sh	Pin Homebrew installer script to a commit and verify SHA-256 before execution.
install_scripts/lib/dotinstaller/install-fonts.sh	Pin font downloads to fixed releases and verify SHA-256 checksums.
install_scripts/lib/dotinstaller/install-brewfile.sh	Pin homebrew-file installer to a commit and verify SHA-256 before execution.
.github/workflows/neovim-health.yml	Pin third-party actions to full commit SHAs.
.github/workflows/lua-lint.yml	Pin actions and add SHA-256 verification for downloaded lint tool binaries.
.github/workflows/gitguardian.yml	Pin GitGuardian action (and checkout) to full commit SHAs.
.config/zsh/rc/pluginlist.zsh	Pin zinit/plugins to fixed revisions (plugins via ver"<sha>").
.config/nvim/lua/rc/plugins/init.lua	Pin lazy.nvim bootstrap to a specific commit referenced from lazy-lock.json.

Comments suppressed due to low confidence (1)

.config/nvim/lua/rc/plugins/init.lua:13

• If the git checkout <commit> fails (e.g., commit not reachable from the cloned branch), vim.v.shell_error will be non-zero but out still contains the clone output and the error text says "Failed to clone". Capture and report the checkout output separately and update the error message to reflect whether clone or checkout failed.

  local out = vim.fn.system({ "git", "clone", "--filter=blob:none", "--single-branch", lazyrepo, lazypath })
  if vim.v.shell_error == 0 then
    vim.fn.system({ "git", "-C", lazypath, "checkout", "306a05526ada86a7b30af95c5cc81ffba93fef97" })
  end
  if vim.v.shell_error ~= 0 then
    vim.api.nvim_echo({
      { "Failed to clone lazy.nvim:\n", "ErrorMsg" },
      { out, "WarningMsg" },

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

.config/nvim/lua/rc/plugins/init.lua:13

• If git clone succeeds but the subsequent git checkout <sha> fails, the error shown will still say "Failed to clone lazy.nvim" and will display the clone output (not the checkout failure), because out isn't updated for the checkout step. Capture and check the checkout result separately (and adjust the message to something like "Failed to install lazy.nvim") so failures are diagnosable.

  local out = vim.fn.system({ "git", "clone", "--filter=blob:none", "--single-branch", lazyrepo, lazypath })
  if vim.v.shell_error == 0 then
    vim.fn.system({ "git", "-C", lazypath, "checkout", "306a05526ada86a7b30af95c5cc81ffba93fef97" })
  end
  if vim.v.shell_error ~= 0 then
    vim.api.nvim_echo({
      { "Failed to clone lazy.nvim:\n", "ErrorMsg" },
      { out, "WarningMsg" },

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.