ci: add dependency and workflow security scans

.github/workflows/ci.yml

@@ -13,12 +13,18 @@ concurrency:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   ci:
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    env:
+      NODE_USE_SYSTEM_CA: "1"
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@27b9d9cb079918e6be16c8660f82bb0cf7fef6ea
+
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:

.github/workflows/dependency-scan.yml

@@ -0,0 +1,13 @@
+name: Dependency Scan
+
+"on":
+  pull_request:
+
+permissions: {}
+
+jobs:
+  dependency-scan:
+    uses: tempoxyz/gh-actions/.github/workflows/dependency-scan.yml@25cce154e7fb10f99361a166468a6c56b9c31aa3
+    permissions:
+      contents: read
+      id-token: write

.github/workflows/release-tags.yml

@@ -6,12 +6,16 @@ on:
 
 permissions:
   contents: write
+  id-token: write
 
 jobs:
   update-tags:
     name: Update major version tag
     runs-on: ubuntu-latest
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@27b9d9cb079918e6be16c8660f82bb0cf7fef6ea
+
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -26,6 +30,7 @@ jobs:
 
       - name: Update major version tag
         env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ github.event.release.tag_name }}
         run: |
           # Extract major version (e.g., v1)
@@ -65,5 +70,3 @@ jobs:
             echo "Tag $TAG does not match expected format (vX.Y.Z)"
             exit 1
           fi
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -23,7 +23,12 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    env:
+      NODE_USE_SYSTEM_CA: "1"
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@27b9d9cb079918e6be16c8660f82bb0cf7fef6ea
+
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -79,18 +84,18 @@ jobs:
           # Wait for changeset tag to be available
           MAX_ATTEMPTS=10
           SLEEP_SECONDS=2
-          for i in $(seq 1 $MAX_ATTEMPTS); do
+          for i in $(seq 1 "$MAX_ATTEMPTS"); do
             git fetch --tags origin
             if git rev-parse "$CHANGESET_TAG" >/dev/null 2>&1; then
               echo "Changeset tag $CHANGESET_TAG found"
               break
             fi
-            if [ $i -eq $MAX_ATTEMPTS ]; then
+            if [ "$i" -eq "$MAX_ATTEMPTS" ]; then
               echo "Error: Tag $CHANGESET_TAG not found after $MAX_ATTEMPTS attempts"
               exit 1
             fi
             echo "Attempt $i/$MAX_ATTEMPTS: Tag not yet available, waiting..."
-            sleep $SLEEP_SECONDS
+            sleep "$SLEEP_SECONDS"
           done
 
           # Create the vX.Y.Z tag pointing to the same commit

.github/workflows/scan-github-actions.yml

@@ -0,0 +1,16 @@
+name: Scan GitHub Actions
+
+"on":
+  pull_request:
+
+permissions: {}
+
+jobs:
+  scan:
+    name: Scan GitHub Actions
+    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@6a4184039b7a7537d35ace0badc96764d5a1d4d0
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      security-events: write

action.yml

@@ -85,28 +85,34 @@ runs:
       id: run-lint
       shell: bash
       working-directory: ${{ github.workspace }}
+      env:
+        EXCLUDE_RULES: ${{ inputs.exclude-rules }}
+        FIX: ${{ inputs.fix }}
+        LANGUAGE: ${{ inputs.language }}
+        POST_COMMENT: ${{ inputs.post-comment }}
+        SCAN_PATH_INPUT: ${{ inputs.path }}
       run: |
         # Resolve scan path (default to workspace root)
-        SCAN_PATH="${{ inputs.path }}"
+        SCAN_PATH="$SCAN_PATH_INPUT"
         if [ "$SCAN_PATH" = "." ]; then
           SCAN_PATH="${{ github.workspace }}"
         fi
 
         # Build CLI args - use JSON output if PR comment is needed
-        if [ "${{ inputs.post-comment }}" = "true" ] && [ "${{ github.event_name }}" = "pull_request" ]; then
+        if [ "$POST_COMMENT" = "true" ] && [ "${{ github.event_name }}" = "pull_request" ]; then
           OUTPUT_FORMAT="--json"
         else
           OUTPUT_FORMAT="--github-action"
         fi
 
         # Build CLI args array for safe parameter passing
-        CLI_ARGS=("${{ inputs.language }}" "$SCAN_PATH" "$OUTPUT_FORMAT")
+        CLI_ARGS=("$LANGUAGE" "$SCAN_PATH" "$OUTPUT_FORMAT")
 
-        if [ -n "${{ inputs.exclude-rules }}" ]; then
-          CLI_ARGS+=("--exclude" "${{ inputs.exclude-rules }}")
+        if [ -n "$EXCLUDE_RULES" ]; then
+          CLI_ARGS+=("--exclude" "$EXCLUDE_RULES")
         fi
 
-        if [ "${{ inputs.fix }}" = "true" ]; then
+        if [ "$FIX" = "true" ]; then
           CLI_ARGS+=("--fix")
         fi
 
@@ -144,14 +150,14 @@ runs:
       shell: bash
       env:
         GITHUB_TOKEN: ${{ inputs.github-token }}
+        LANGUAGE: ${{ inputs.language }}
+        OUTPUT_FILE: ${{ steps.run-lint.outputs.output_file }}
       run: |
         if [ -z "$GITHUB_TOKEN" ]; then
           echo "::warning::github-token is required for posting PR comments"
           exit 0
         fi
 
-        OUTPUT_FILE="${{ steps.run-lint.outputs.output_file }}"
-
         # Validate output file exists
         if [ ! -f "$OUTPUT_FILE" ]; then
           echo "::error::Output file not found at $OUTPUT_FILE"
@@ -166,13 +172,14 @@ runs:
           "$TOTAL_ISSUES" \
           "${{ github.repository }}" \
           "${{ github.event.pull_request.number }}" \
-          "${{ inputs.language }}"
+          "$LANGUAGE"
 
     - name: Check for failures
       if: inputs.fail-on-error == 'true'
       shell: bash
+      env:
+        EXIT_CODE: ${{ steps.run-lint.outputs.exit_code }}
       run: |
-        EXIT_CODE="${{ steps.run-lint.outputs.exit_code }}"
         if [ "$EXIT_CODE" != "0" ]; then
           echo "::error::Lint errors found. Fix the issues above or set fail-on-error to false."
           exit 1