From c4ae7927ad42af79762317cb52ea4d02569f9967 Mon Sep 17 00:00:00 2001
From: link2xt <link2xt@testrun.org>
Date: Wed, 29 Apr 2026 00:47:19 +0200
Subject: [PATCH] Setup zizmor workflow to check GitHub Actions workflows

---
 .github/workflows/artifacts.yml   |  8 +++++++-
 .github/workflows/cache-core.yml  |  9 ++++++---
 .github/workflows/code-format.yml |  6 +++++-
 .github/workflows/preview-apk.yml | 11 +++++++----
 .github/workflows/zizmor-scan.yml | 26 ++++++++++++++++++++++++++
 .github/zizmor.yml                |  6 ++++++
 6 files changed, 57 insertions(+), 9 deletions(-)
 create mode 100644 .github/workflows/zizmor-scan.yml
 create mode 100644 .github/zizmor.yml

diff --git a/.github/workflows/artifacts.yml b/.github/workflows/artifacts.yml
index 4267113ba..f0b819ed8 100644
--- a/.github/workflows/artifacts.yml
+++ b/.github/workflows/artifacts.yml
@@ -4,14 +4,20 @@ on:
     workflows: ["Upload Preview APK"]
     types: [completed]
 
+permissions: {}
+
 jobs:
   artifacts-url-comments:
     name: add artifact links to pull request
+    permissions:
+      pull-requests: write
+      actions: read
+      contents: read
     runs-on: ubuntu-latest
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - name: add artifact links to pull request
-        uses: tonyhallett/artifacts-url-comments@v1.1.0
+        uses: tonyhallett/artifacts-url-comments@0965ff1a7ae03c5c1644d3c30f956effea4e05ef # v1.1.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/cache-core.yml b/.github/workflows/cache-core.yml
index 2e00c8d50..8db29fcf9 100644
--- a/.github/workflows/cache-core.yml
+++ b/.github/workflows/cache-core.yml
@@ -10,6 +10,8 @@ on:
       - 'jni/dc_wrapper.c'
       - 'scripts/ndk-make.sh'
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -17,14 +19,15 @@ jobs:
       - uses: actions/checkout@v5
         with:
           submodules: recursive
+          persist-credentials: false
 
-      - uses: android-actions/setup-android@v3
-      - uses: nttld/setup-ndk@v1
+      - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+      - uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1.6.0
         id: setup-ndk
         with:
           ndk-version: r27
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           workspaces: jni/deltachat-core-rust
 
diff --git a/.github/workflows/code-format.yml b/.github/workflows/code-format.yml
index ab4c42521..2eb46e769 100644
--- a/.github/workflows/code-format.yml
+++ b/.github/workflows/code-format.yml
@@ -5,6 +5,8 @@ on:
     branches: [main]
   pull_request:
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
@@ -17,6 +19,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
       - uses: actions/setup-java@v5
         with:
           java-version: 17
@@ -30,6 +34,6 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-gradle-
       - name: Validate Gradle Wrapper
-        uses: gradle/actions/wrapper-validation@v4
+        uses: gradle/actions/wrapper-validation@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
       - name: Check formatting
         run: ./gradlew spotlessCheck
diff --git a/.github/workflows/preview-apk.yml b/.github/workflows/preview-apk.yml
index 8dd204049..7dd8fe178 100644
--- a/.github/workflows/preview-apk.yml
+++ b/.github/workflows/preview-apk.yml
@@ -6,6 +6,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions: {}
+
 jobs:
   build:
     name: Upload Preview APK
@@ -14,6 +16,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           submodules: recursive
+          persist-credentials: false
 
       - uses: actions/setup-java@v5
         with:
@@ -30,15 +33,15 @@ jobs:
             ${{ runner.os }}-gradle-
 
       - name: Validate Gradle Wrapper
-        uses: gradle/actions/wrapper-validation@v4
+        uses: gradle/actions/wrapper-validation@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
 
-      - uses: android-actions/setup-android@v3
-      - uses: nttld/setup-ndk@v1
+      - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+      - uses: nttld/setup-ndk@ed92fe6cadad69be94a966a7ee3271275e62f779 # v1.6.0
         id: setup-ndk
         with:
           ndk-version: r27
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
           workspaces: jni/deltachat-core-rust
 
diff --git a/.github/workflows/zizmor-scan.yml b/.github/workflows/zizmor-scan.yml
new file mode 100644
index 000000000..af97e663b
--- /dev/null
+++ b/.github/workflows/zizmor-scan.yml
@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 000000000..a40e4188f
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,6 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: ref-pin
+        dependabot/*: ref-pin