ci(security): pin actions to SHAs, enforce workflow lint, weekly Semgrep

.github/workflows/coverage.yml

@@ -23,9 +23,11 @@ jobs:
       # Job-level env cannot use the runner context; RUNNER_TEMP is set by the runner.
       - name: Point TMPDIR at runner temp
         run: echo "TMPDIR=$RUNNER_TEMP" >> "$GITHUB_ENV"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       # Minis persist ~/.npm on disk. GitHub's remote cache is 0.4–1 MB/s for ~1.4 GB.
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           package-manager-cache: false
@@ -38,7 +40,7 @@ jobs:
           test -s packages/chart/coverage/lcov.info
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./packages/chart/coverage/lcov.info

.github/workflows/docs.yml

@@ -20,7 +20,7 @@ jobs:
   security:
     # Release scan, parallel with build. Skipped on PRs.
     if: github.event_name != 'pull_request'
-    uses: bloxwap/.github/.github/workflows/security-scan.yml@6755bcc6a591531ae95a5babfa389c329f71ba0b # v1.0.2
+    uses: bloxwap/.github/.github/workflows/security-scan.yml@2a70724cd0d803abef5f5a7c64c46065f4fda19b # v1.1.0
     permissions:
       contents: read
     with:
@@ -44,9 +44,11 @@ jobs:
         run: |
           echo "TMPDIR=$RUNNER_TEMP" >> "$GITHUB_ENV"
           echo "PLAYWRIGHT_BROWSERS_PATH=$RUNNER_TEMP/ms-playwright" >> "$GITHUB_ENV"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       # Minis persist ~/.npm on disk. GitHub's remote cache is 0.4–1 MB/s for ~1.4 GB.
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           package-manager-cache: false
@@ -67,7 +69,7 @@ jobs:
             echo '::error::gtar (GNU tar) is required for actions/upload-pages-artifact on macOS. Install with: brew install gnu-tar'
             exit 1
           fi
-      - uses: actions/upload-pages-artifact@v5
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         if: github.event_name != 'pull_request'
         with:
           path: apps/docs/out
@@ -84,7 +86,7 @@ jobs:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
-      - uses: actions/configure-pages@v6
+      - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1

.github/workflows/publish_npm.yml

@@ -22,7 +22,7 @@ concurrency:
 jobs:
   security:
     # Single-job publish: adds the scan serially.
-    uses: bloxwap/.github/.github/workflows/security-scan.yml@6755bcc6a591531ae95a5babfa389c329f71ba0b # v1.0.2
+    uses: bloxwap/.github/.github/workflows/security-scan.yml@2a70724cd0d803abef5f5a7c64c46065f4fda19b # v1.1.0
     permissions:
       contents: read
     with:
@@ -45,9 +45,11 @@ jobs:
       # Job-level env cannot use the runner context; RUNNER_TEMP is set by the runner.
       - name: Point TMPDIR at runner temp
         run: echo "TMPDIR=$RUNNER_TEMP" >> "$GITHUB_ENV"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       # Minis persist ~/.npm on disk. GitHub's remote cache is 0.4–1 MB/s for ~1.4 GB.
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'

.github/workflows/security-nightly.yml

@@ -15,6 +15,8 @@ on:
   pull_request:
     paths:
       - .github/workflows/security-nightly.yml
+      - .github/workflows/**        # enforced workflow lint runs on workflow changes
+      - .github/actions/**
       - osv-scanner.toml
       - .gitleaksignore
       - .gitleaks.toml
@@ -29,12 +31,13 @@ jobs:
   scan:
     # Fork guard: never run fork PR code on self-hosted minis
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    uses: bloxwap/.github/.github/workflows/security-scan.yml@6755bcc6a591531ae95a5babfa389c329f71ba0b # v1.0.2
+    uses: bloxwap/.github/.github/workflows/security-scan.yml@2a70724cd0d803abef5f5a7c64c46065f4fda19b # v1.1.0
     permissions:
       contents: read
     with:
       runs-on: '["self-hosted","macOS","ARM64"]'
       profile: nightly
+      enforce-workflow-lint: true   # actionlint + zizmor (medium+) must pass; clean as of 2026-10-26
       secrets-mode: ${{ inputs.secrets-mode || (github.event.schedule == '31 12 * * 0' && 'full' || 'incremental') }}
       upload-sarif: false     # no GHAS code scanning
       upload-secret-report: false

.github/workflows/security-pr.yml

@@ -16,7 +16,7 @@ jobs:
   gate:
     # Fork guard: never run fork PR code on self-hosted minis
     if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
-    uses: bloxwap/.github/.github/workflows/security-pr-gate.yml@6755bcc6a591531ae95a5babfa389c329f71ba0b # v1.0.2
+    uses: bloxwap/.github/.github/workflows/security-pr-gate.yml@2a70724cd0d803abef5f5a7c64c46065f4fda19b # v1.1.0
     permissions:
       contents: read
     with:

.github/workflows/security-weekly.yml

@@ -0,0 +1,36 @@
+# Weekly SAST (Semgrep, report-only). Shared logic: bloxwap/.github/.github/workflows/security-scan.yml
+# Never fails and never gates a release. Findings go to the job summary; Slack only for High findings.
+name: security-weekly
+
+on:
+  schedule:
+    - cron: "3 15 * * 6"   # Saturdays 15:03 UTC, staggered across repos after the nightlies
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - .github/workflows/security-weekly.yml
+      - .semgrepignore
+
+permissions: {}
+
+concurrency:
+  group: security-weekly-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  semgrep:
+    # Fork guard: never run fork PR code on self-hosted minis
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    uses: bloxwap/.github/.github/workflows/security-scan.yml@2a70724cd0d803abef5f5a7c64c46065f4fda19b # v1.1.0
+    permissions:
+      contents: read
+    with:
+      runs-on: '["self-hosted","macOS","ARM64"]'
+      profile: nightly
+      deps: false
+      secrets-scan: false
+      workflow-lint: false
+      semgrep: true
+      semgrep-config: p/default
+    secrets:
+      SLACK_WEBHOOK_URL: ${{ secrets.SLACK_SECURITY_WEBHOOK_URL }}  # optional; without it Slack is skipped

.github/workflows/tests.yml

@@ -55,9 +55,11 @@ jobs:
       # Job-level env cannot use the runner context; RUNNER_TEMP is set by the runner.
       - name: Point TMPDIR at runner temp
         run: echo "TMPDIR=$RUNNER_TEMP" >> "$GITHUB_ENV"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       # Minis persist ~/.npm on disk. GitHub's remote cache is 0.4–1 MB/s for ~1.4 GB.
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           package-manager-cache: false