ci: add zizmor workflow security scanner (#3506)

Adds zizmor alongside the actionlint job from #3503. Both now run as parallel jobs in a single `.github/workflows/workflow-checks.yml`, triggered on `.github/workflows/**` and `.github/actions/**` changes. Zizmor is configured with `unpinned-uses: hash-pin` policy via `.github/zizmor.yml`, so any future unpinned action will fail CI. Findings upload SARIF to the Security tab alongside CodeQL. Bulk of the diff is cleanup of the findings zizmor surfaced on first run. `zizmor --fix=all` handled most of them mechanically; the rest were judgment calls.
2026-05-05 09:20:08 +01:00
parent 5dab2ae714
commit 3d418a9482
24 changed files with 233 additions and 72 deletions
@@ -23,35 +23,37 @@ runs:
      id: get_tag
      shell: bash
      run: |
-        if [[ -n "${{ inputs.tag }}" ]]; then
-          tag="${{ inputs.tag }}"
-        elif [[ "${{ github.ref_type }}" == "tag" ]]; then
-          if [[ "${{ github.ref_name }}" == infra-*-* ]]; then
-            env=$(echo ${{ github.ref_name }} | cut -d- -f2)
-            sha=$(echo ${{ github.sha }} | head -c7)
+        if [[ -n "${INPUTS_TAG}" ]]; then
+          tag="${INPUTS_TAG}"
+        elif [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+          if [[ "${GITHUB_REF_NAME}" == infra-*-* ]]; then
+            env=$(echo ${GITHUB_REF_NAME} | cut -d- -f2)
+            sha=$(echo "${GITHUB_SHA}" | head -c7)
            ts=$(date +%s)
            tag=${env}-${sha}-${ts}
-          elif [[ "${{ github.ref_name }}" == re2-*-* ]]; then
-            env=$(echo ${{ github.ref_name }} | cut -d- -f2)
-            sha=$(echo ${{ github.sha }} | head -c7)
+          elif [[ "${GITHUB_REF_NAME}" == re2-*-* ]]; then
+            env=$(echo ${GITHUB_REF_NAME} | cut -d- -f2)
+            sha=$(echo "${GITHUB_SHA}" | head -c7)
            ts=$(date +%s)
            tag=${env}-${sha}-${ts}
-          elif [[ "${{ github.ref_name }}" == v.docker.* ]]; then
+          elif [[ "${GITHUB_REF_NAME}" == v.docker.* ]]; then
            version="${GITHUB_REF_NAME#v.docker.}"
            tag="v${version}"
-          elif [[ "${{ github.ref_name }}" == build-* ]]; then
+          elif [[ "${GITHUB_REF_NAME}" == build-* ]]; then
            tag="${GITHUB_REF_NAME#build-}"
          else
-            echo "Invalid git tag: ${{ github.ref_name }}"
+            echo "Invalid git tag: ${GITHUB_REF_NAME}"
            exit 1
          fi
-        elif [[ "${{ github.ref_name }}" == "main" ]]; then
+        elif [[ "${GITHUB_REF_NAME}" == "main" ]]; then
          tag="main"
        else
-          echo "Invalid git ref: ${{ github.ref }}"
+          echo "Invalid git ref: ${GITHUB_REF}"
          exit 1
        fi
        echo "tag=${tag}" >> "$GITHUB_OUTPUT"
+      env:
+        INPUTS_TAG: ${{ inputs.tag }}

    - name: 🔍 Check for validity
      id: check_validity
@@ -25,7 +25,7 @@ jobs:
    if: github.repository == 'triggerdotdev/trigger.dev'
    steps:
      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] changesets/action pushes the release branch; no artifact upload here so no leak path
        with:
          fetch-depth: 0

@@ -30,6 +30,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: Run Claude Code
        id: claude
@@ -29,6 +29,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 1
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -27,6 +27,8 @@ jobs:
    steps:
      - name: 📥 Checkout repository
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: 📦 Cache npm
        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
@@ -5,6 +5,11 @@ permissions:

 on:
  workflow_call:
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: false
+      DOCKERHUB_TOKEN:
+        required: false

 jobs:
  e2eTests:
@@ -44,6 +49,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -27,6 +27,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -34,6 +34,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: Set up Helm
        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
@@ -78,6 +80,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: Set up Helm
        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
@@ -108,11 +112,11 @@ jobs:
            SHORT_SHA=$(echo "${{ github.event.pull_request.head.sha }}" | cut -c1-7)
            PRERELEASE_VERSION="${BASE_VERSION}-pr${PR_NUMBER}.${SHORT_SHA}"
          elif [[ "${{ github.event_name }}" == "push" ]]; then
-            SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
+            SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
            PRERELEASE_VERSION="${BASE_VERSION}-main.${SHORT_SHA}"
          else
-            SHORT_SHA=$(echo "${{ github.sha }}" | cut -c1-7)
-            REF_SLUG=$(echo "${{ github.ref_name }}" | tr '/' '-' | tr -cd 'a-zA-Z0-9-')
+            SHORT_SHA=$(echo "${GITHUB_SHA}" | cut -c1-7)
+            REF_SLUG=$(echo "${GITHUB_REF_NAME}" | tr '/' '-' | tr -cd 'a-zA-Z0-9-')
            if [[ -z "$REF_SLUG" ]]; then
              REF_SLUG="manual"
            fi
@@ -123,7 +127,9 @@ jobs:

      - name: Update Chart.yaml with prerelease version
        run: |
-          sed -i "s/^version:.*/version: ${{ steps.version.outputs.version }}/" ./hosting/k8s/helm/Chart.yaml
+          sed -i "s/^version:.*/version: ${STEPS_VERSION_OUTPUTS_VERSION}/" ./hosting/k8s/helm/Chart.yaml
+        env:
+          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Override appVersion
        if: github.event_name == 'workflow_dispatch' && inputs.app_version != ''
@@ -138,26 +144,30 @@ jobs:

      - name: Push Helm Chart to GHCR
        run: |
-          VERSION="${{ steps.version.outputs.version }}"
+          VERSION="${STEPS_VERSION_OUTPUTS_VERSION}"
          CHART_PACKAGE="/tmp/${{ env.CHART_NAME }}-${VERSION}.tgz"

          # Push to GHCR OCI registry
          helm push "$CHART_PACKAGE" "oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts"
+        env:
+          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Write run summary
        run: |
          {
            echo "### 🧭 Helm Chart Prerelease Published"
            echo ""
-            echo "**Version:** \`${{ steps.version.outputs.version }}\`"
+            echo "**Version:** \`${STEPS_VERSION_OUTPUTS_VERSION}\`"
            echo ""
            echo "**Install:**"
            echo '```bash'
            echo "helm upgrade --install trigger \\"
            echo "  oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts/${{ env.CHART_NAME }} \\"
-            echo "  --version \"${{ steps.version.outputs.version }}\""
+            echo "  --version \"${STEPS_VERSION_OUTPUTS_VERSION}\""
            echo '```'
          } >> "$GITHUB_STEP_SUMMARY"
+        env:
+          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Find existing comment
        if: github.event_name == 'pull_request'
@@ -15,23 +15,21 @@ concurrency:

 permissions:
  contents: read
-  id-token: write

 jobs:
  typecheck:
    uses: ./.github/workflows/typecheck.yml
-    secrets: inherit

  units:
    uses: ./.github/workflows/unit-tests.yml
-    secrets: inherit
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

  e2e:
    uses: ./.github/workflows/e2e.yml
    with:
      package: cli-v3
-    secrets: inherit

  sdk-compat:
    uses: ./.github/workflows/sdk-compat.yml
-    secrets: inherit
@@ -13,6 +13,9 @@ on:
        type: string
        required: false
        default: ""
+    secrets:
+      SENTRY_AUTH_TOKEN:
+        required: false

 jobs:
  publish:
@@ -30,6 +33,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          submodules: recursive
+          persist-credentials: false

      - name: "#️⃣ Get the image tag"
        id: get_tag
@@ -40,34 +44,40 @@ jobs:
      - name: 🔢 Get the commit hash
        id: get_commit
        run: |
-          echo "sha_short=$(echo ${{ github.sha }} | cut -c1-7)" >> "$GITHUB_OUTPUT"
+          echo "sha_short=$(echo "${GITHUB_SHA}" | cut -c1-7)" >> "$GITHUB_OUTPUT"

      - name: 📛 Set the tags
        id: set_tags
        run: |
          ref_without_tag=ghcr.io/triggerdotdev/trigger.dev
-          image_tags=$ref_without_tag:${{ steps.get_tag.outputs.tag }}
+          image_tags=$ref_without_tag:${STEPS_GET_TAG_OUTPUTS_TAG}

          # if tag is a semver, also tag it as v4
-          if [[ "${{ steps.get_tag.outputs.is_semver }}" == true ]]; then
+          if [[ "${STEPS_GET_TAG_OUTPUTS_IS_SEMVER}" == true ]]; then
            # TODO: switch to v4 tag on GA
            image_tags=$image_tags,$ref_without_tag:v4-beta
          fi

          echo "image_tags=${image_tags}" >> "$GITHUB_OUTPUT"
+        env:
+          STEPS_GET_TAG_OUTPUTS_TAG: ${{ steps.get_tag.outputs.tag }}
+          STEPS_GET_TAG_OUTPUTS_IS_SEMVER: ${{ steps.get_tag.outputs.is_semver }}

      - name: 📝 Set the build info
        id: set_build_info
        run: |
          {
-            tag="${{ steps.get_tag.outputs.tag }}"
-            if [[ "${{ steps.get_tag.outputs.is_semver }}" == true ]]; then
+            tag="${STEPS_GET_TAG_OUTPUTS_TAG}"
+            if [[ "${STEPS_GET_TAG_OUTPUTS_IS_SEMVER}" == true ]]; then
              echo "BUILD_APP_VERSION=${tag}"
            fi
-            echo "BUILD_GIT_SHA=${{ github.sha }}"
-            echo "BUILD_GIT_REF_NAME=${{ github.ref_name }}"
+            echo "BUILD_GIT_SHA=${GITHUB_SHA}"
+            echo "BUILD_GIT_REF_NAME=${GITHUB_REF_NAME}"
            echo "BUILD_TIMESTAMP_SECONDS=$(date +%s)"
          } >> "$GITHUB_OUTPUT"
+        env:
+          STEPS_GET_TAG_OUTPUTS_TAG: ${{ steps.get_tag.outputs.tag }}
+          STEPS_GET_TAG_OUTPUTS_IS_SEMVER: ${{ steps.get_tag.outputs.is_semver }}

      - name: 🐙 Login to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -41,6 +41,8 @@ jobs:

      - name: ⬇️ Checkout git repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: 📦 Get image repo
        id: get_repository
@@ -63,16 +65,20 @@ jobs:
      - name: 📛 Set tags to push
        id: set_tags
        run: |
-          ref_without_tag=ghcr.io/triggerdotdev/${{ steps.get_repository.outputs.repo }}
-          image_tags=$ref_without_tag:${{ steps.get_tag.outputs.tag }}
+          ref_without_tag=ghcr.io/triggerdotdev/${STEPS_GET_REPOSITORY_OUTPUTS_REPO}
+          image_tags=$ref_without_tag:${STEPS_GET_TAG_OUTPUTS_TAG}

          # if tag is a semver, also tag it as v4
-          if [[ "${{ steps.get_tag.outputs.is_semver }}" == true ]]; then
+          if [[ "${STEPS_GET_TAG_OUTPUTS_IS_SEMVER}" == true ]]; then
            # TODO: switch to v4 tag on GA
            image_tags=$image_tags,$ref_without_tag:v4-beta
          fi

          echo "image_tags=${image_tags}" >> "$GITHUB_OUTPUT"
+        env:
+          STEPS_GET_REPOSITORY_OUTPUTS_REPO: ${{ steps.get_repository.outputs.repo }}
+          STEPS_GET_TAG_OUTPUTS_TAG: ${{ steps.get_tag.outputs.tag }}
+          STEPS_GET_TAG_OUTPUTS_IS_SEMVER: ${{ steps.get_tag.outputs.is_semver }}

      - name: 🐙 Login to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -8,6 +8,11 @@ on:
        type: string
        required: false
        default: ""
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: false
+      DOCKERHUB_TOKEN:
+        required: false
  push:
    tags:
      - "infra-dev-*"
@@ -26,9 +31,12 @@ jobs:
    runs-on: ubuntu-latest
    env:
      DOCKER_BUILDKIT: "1"
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
    steps:
      - name: ⬇️ Checkout git repo
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: 📦 Get image repo
        id: get_repository
@@ -52,6 +60,7 @@ jobs:

      # ..to avoid rate limits when pulling images
      - name: 🐳 Login to DockerHub
+        if: ${{ env.DOCKERHUB_USERNAME }}
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -8,6 +8,13 @@ on:
        description: The image tag to publish
        required: true
        type: string
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: false
+      DOCKERHUB_TOKEN:
+        required: false
+      SENTRY_AUTH_TOKEN:
+        required: false
  push:
    branches:
      - main
@@ -37,8 +44,6 @@ on:
      - "tests/**"

 permissions:
-  id-token: write
-  packages: write
  contents: read

 concurrency:
@@ -50,29 +55,43 @@ env:
 jobs:
  typecheck:
    uses: ./.github/workflows/typecheck.yml
-    secrets: inherit

  units:
    uses: ./.github/workflows/unit-tests.yml
-    secrets: inherit
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}

  publish-webapp:
    needs: [typecheck]
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
    uses: ./.github/workflows/publish-webapp.yml
-    secrets: inherit
+    secrets:
+      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
    with:
      image_tag: ${{ inputs.image_tag }}

  publish-worker:
    needs: [typecheck]
+    permissions:
+      contents: read
+      packages: write
    uses: ./.github/workflows/publish-worker.yml
-    secrets: inherit
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
    with:
      image_tag: ${{ inputs.image_tag }}

  publish-worker-v4:
    needs: [typecheck]
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
    uses: ./.github/workflows/publish-worker-v4.yml
-    secrets: inherit
    with:
      image_tag: ${{ inputs.image_tag }}
@@ -29,6 +29,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: Set up Helm
        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
@@ -68,6 +70,8 @@ jobs:
    steps:
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false

      - name: Set up Helm
        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
@@ -92,18 +96,20 @@ jobs:
      - name: Extract version from tag or input
        id: version
        run: |
-          if [ -n "${{ inputs.chart_version }}" ]; then
-            VERSION="${{ inputs.chart_version }}"
+          if [ -n "${INPUTS_CHART_VERSION}" ]; then
+            VERSION="${INPUTS_CHART_VERSION}"
          else
-            VERSION="${{ github.ref_name }}"
+            VERSION="${GITHUB_REF_NAME}"
            VERSION="${VERSION#helm-v}"
          fi
          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
          echo "Releasing version: $VERSION"
+        env:
+          INPUTS_CHART_VERSION: ${{ inputs.chart_version }}

      - name: Check Chart.yaml version matches release version
        run: |
-          VERSION="${{ steps.version.outputs.version }}"
+          VERSION="${STEPS_VERSION_OUTPUTS_VERSION}"
          CHART_VERSION=$(grep '^version:' ./hosting/k8s/helm/Chart.yaml | awk '{print $2}')
          echo "Chart.yaml version: $CHART_VERSION"
          echo "Release version: $VERSION"
@@ -112,6 +118,8 @@ jobs:
            exit 1
          fi
          echo "✅ Chart.yaml version matches release version."
+        env:
+          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Package Helm Chart
        run: |
@@ -119,11 +127,13 @@ jobs:

      - name: Push Helm Chart to GHCR
        run: |
-          VERSION="${{ steps.version.outputs.version }}"
+          VERSION="${STEPS_VERSION_OUTPUTS_VERSION}"
          CHART_PACKAGE="/tmp/${{ env.CHART_NAME }}-${VERSION}.tgz"
          
          # Push to GHCR OCI registry
          helm push "$CHART_PACKAGE" "oci://${{ env.REGISTRY }}/${{ github.repository_owner }}/charts"
+        env:
+          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}

      - name: Create GitHub Release
        id: release
@@ -33,6 +33,7 @@ jobs:
  show-release-summary:
    name: 📋 Release Summary
    runs-on: ubuntu-latest
+    permissions: {}
    if: |
      github.repository == 'triggerdotdev/trigger.dev' &&
      github.event_name == 'pull_request' &&
@@ -65,7 +66,7 @@ jobs:
      published_package_version: ${{ steps.get_version.outputs.package_version }}
    steps:
      - name: Checkout repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 # zizmor: ignore[artipacked] needs persisted git creds for tag push; no artifact upload here so no leak path
        with:
          fetch-depth: 0
          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ref || github.sha }}
@@ -73,10 +74,12 @@ jobs:
      - name: Verify ref is on main
        if: github.event_name == 'workflow_dispatch'
        run: |
-          if ! git merge-base --is-ancestor ${{ github.event.inputs.ref }} origin/main; then
+          if ! git merge-base --is-ancestor "${GITHUB_EVENT_INPUTS_REF}" origin/main; then
            echo "Error: ref must be an ancestor of main (i.e., already merged)"
            exit 1
          fi
+        env:
+          GITHUB_EVENT_INPUTS_REF: ${{ github.event.inputs.ref }}

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -119,16 +122,19 @@ jobs:
        if: steps.changesets.outputs.published == 'true'
        id: get_version
        run: |
-          package_version=$(echo '${{ steps.changesets.outputs.publishedPackages }}' | jq -r '.[0].version')
+          package_version=$(echo "${STEPS_CHANGESETS_OUTPUTS_PUBLISHEDPACKAGES}" | jq -r '.[0].version')
          echo "package_version=${package_version}" >> "$GITHUB_OUTPUT"
+        env:
+          STEPS_CHANGESETS_OUTPUTS_PUBLISHEDPACKAGES: ${{ steps.changesets.outputs.publishedPackages }}

      - name: Create unified GitHub release
        if: steps.changesets.outputs.published == 'true'
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          RELEASE_PR_BODY: ${{ github.event.pull_request.body }}
+          STEPS_GET_VERSION_OUTPUTS_PACKAGE_VERSION: ${{ steps.get_version.outputs.package_version }}
        run: |
-          VERSION="${{ steps.get_version.outputs.package_version }}"
+          VERSION="${STEPS_GET_VERSION_OUTPUTS_PACKAGE_VERSION}"
          node scripts/generate-github-release.mjs "$VERSION" > /tmp/release-body.md
          gh release create "v${VERSION}" \
            --title "trigger.dev v${VERSION}" \
@@ -139,15 +145,19 @@ jobs:
        if: steps.changesets.outputs.published == 'true'
        run: |
          set -e
-          git tag "v.docker.${{ steps.get_version.outputs.package_version }}"
-          git push origin "v.docker.${{ steps.get_version.outputs.package_version }}"
+          git tag "v.docker.${STEPS_GET_VERSION_OUTPUTS_PACKAGE_VERSION}"
+          git push origin "v.docker.${STEPS_GET_VERSION_OUTPUTS_PACKAGE_VERSION}"
+        env:
+          STEPS_GET_VERSION_OUTPUTS_PACKAGE_VERSION: ${{ steps.get_version.outputs.package_version }}

      - name: Create and push Helm chart tag
        if: steps.changesets.outputs.published == 'true'
        run: |
          set -e
-          git tag "helm-v${{ steps.get_version.outputs.package_version }}"
-          git push origin "helm-v${{ steps.get_version.outputs.package_version }}"
+          git tag "helm-v${STEPS_GET_VERSION_OUTPUTS_PACKAGE_VERSION}"
+          git push origin "helm-v${STEPS_GET_VERSION_OUTPUTS_PACKAGE_VERSION}"
+        env:
+          STEPS_GET_VERSION_OUTPUTS_PACKAGE_VERSION: ${{ steps.get_version.outputs.package_version }}

  # Trigger Docker builds directly via workflow_call since tags pushed with
  # GITHUB_TOKEN don't trigger other workflows (GitHub Actions limitation).
@@ -155,8 +165,15 @@ jobs:
    name: 🐳 Publish Docker images
    needs: release
    if: needs.release.outputs.published == 'true'
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
    uses: ./.github/workflows/publish.yml
-    secrets: inherit
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
+      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
    with:
      image_tag: v${{ needs.release.outputs.published_package_version }}

@@ -171,7 +188,6 @@ jobs:
      contents: write
      packages: write
    uses: ./.github/workflows/release-helm.yml
-    secrets: inherit
    with:
      chart_version: ${{ needs.release.outputs.published_package_version }}

@@ -189,9 +205,10 @@ jobs:
      - name: Update GitHub release with Docker image link
        env:
          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NEEDS_RELEASE_OUTPUTS_PUBLISHED_PACKAGE_VERSION: ${{ needs.release.outputs.published_package_version }}
        run: |
          set -e
-          VERSION="${{ needs.release.outputs.published_package_version }}"
+          VERSION="${NEEDS_RELEASE_OUTPUTS_PUBLISHED_PACKAGE_VERSION}"
          TAG="v${VERSION}"

          # Query GHCR for the version ID matching this tag
@@ -223,6 +240,7 @@ jobs:
    needs: [release, update-release]
    if: needs.release.outputs.published == 'true'
    runs-on: ubuntu-latest
+    permissions: {}
    steps:
      - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        with:
@@ -246,6 +264,7 @@ jobs:
        with:
          fetch-depth: 0
          ref: ${{ github.event.inputs.ref }}
+          persist-credentials: false

      - name: Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -270,9 +289,10 @@ jobs:
        run: pnpm run generate

      - name: Snapshot version
-        run: pnpm exec changeset version --snapshot ${{ github.event.inputs.prerelease_tag }}
+        run: pnpm exec changeset version --snapshot "${GITHUB_EVENT_INPUTS_PRERELEASE_TAG}"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_EVENT_INPUTS_PRERELEASE_TAG: ${{ github.event.inputs.prerelease_tag }}

      - name: Clean
        run: pnpm run clean --filter "@trigger.dev/*" --filter "trigger.dev"
@@ -281,6 +301,7 @@ jobs:
        run: pnpm run build --filter "@trigger.dev/*" --filter "trigger.dev"

      - name: Publish prerelease
-        run: pnpm exec changeset publish --no-git-tag --snapshot --tag ${{ github.event.inputs.prerelease_tag }}
+        run: pnpm exec changeset publish --no-git-tag --snapshot --tag "${GITHUB_EVENT_INPUTS_PRERELEASE_TAG}"
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_EVENT_INPUTS_PRERELEASE_TAG: ${{ github.event.inputs.prerelease_tag }}
@@ -21,6 +21,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -59,6 +60,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -100,6 +102,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -145,6 +148,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -15,6 +15,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -5,6 +5,11 @@ permissions:

 on:
  workflow_call:
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: false
+      DOCKERHUB_TOKEN:
+        required: false

 jobs:
  unitTests:
@@ -49,6 +54,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -118,6 +124,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -5,6 +5,11 @@ permissions:

 on:
  workflow_call:
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: false
+      DOCKERHUB_TOKEN:
+        required: false

 jobs:
  unitTests:
@@ -49,6 +54,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -118,6 +124,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -5,6 +5,11 @@ permissions:

 on:
  workflow_call:
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: false
+      DOCKERHUB_TOKEN:
+        required: false

 jobs:
  unitTests:
@@ -49,6 +54,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -126,6 +132,7 @@ jobs:
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          fetch-depth: 0
+          persist-credentials: false

      - name: ⎔ Setup pnpm
        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
@@ -5,17 +5,30 @@ permissions:

 on:
  workflow_call:
+    secrets:
+      DOCKERHUB_USERNAME:
+        required: false
+      DOCKERHUB_TOKEN:
+        required: false

 jobs:
  webapp:
    uses: ./.github/workflows/unit-tests-webapp.yml
-    secrets: inherit
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
  e2e-webapp:
    uses: ./.github/workflows/e2e-webapp.yml
-    secrets: inherit
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
  packages:
    uses: ./.github/workflows/unit-tests-packages.yml
-    secrets: inherit
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
  internal:
    uses: ./.github/workflows/unit-tests-internal.yml
-    secrets: inherit
+    secrets:
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
@@ -1,17 +1,18 @@
 name: Vouch - Check PR

 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] needed to comment/close fork PRs; safe because we never check out PR HEAD ref so no fork-controlled code runs
    types: [opened, reopened]

-permissions:
-  contents: read
-  pull-requests: write
-  issues: read
+permissions: {}

 jobs:
  check-vouch:
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write # auto-close unvouched PRs
+      issues: read
    steps:
      - uses: mitchellh/vouch/action/check-pr@c6d80ead49839655b61b422700b7a3bc9d0804a9 # v1.4.2
        with:
@@ -23,6 +24,8 @@ jobs:

  require-draft:
    needs: check-vouch
+    permissions:
+      pull-requests: write # close non-draft PRs with a comment
    if: >
      github.event.pull_request.draft == false &&
      github.event.pull_request.author_association != 'MEMBER' &&
@@ -1,4 +1,4 @@
-name: Actionlint
+name: Workflow Checks

 on:
  push:
@@ -6,10 +6,12 @@ on:
    paths:
      - '.github/workflows/**'
      - '.github/actions/**'
+      - '.github/zizmor.yml'
  pull_request:
    paths:
      - '.github/workflows/**'
      - '.github/actions/**'
+      - '.github/zizmor.yml'

 permissions: {}

@@ -31,3 +33,19 @@ jobs:

      - name: Run actionlint
        uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+
+  zizmor:
+    name: Zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Upload SARIF to GitHub Security tab
+      contents: read # Read workflow files for analysis
+      actions: read # Read workflow run metadata
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        '*': hash-pin