chore: fix zizmor findings in workflows (#431)

* chore: harden GitHub workflows for zizmor

* fix: resolve yamllint line-length and truthy warnings in workflows

* ci: add zizmor workflow to scan PRs

* fix: correct zizmor action repository to zizmorcore/zizmor-action

* chore: remove version comments from SHA-pinned action references

---------

Co-authored-by: Ergin Akin <eakin@scubergphilis.com>

Author: ergousha

.github/dependabot.yml

@@ -5,6 +5,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     groups:
       github-actions-all:
         patterns:
@@ -13,6 +15,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     groups:
       gomod-all:
         patterns:

.github/workflows/action-sorted-inputs.yml

@@ -11,7 +11,9 @@ jobs:
   check-action-inputs-sorted:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
       - name: Validate input key order in action.yml
         run: |
           inputs_file="action.yml"

.github/workflows/general.yml

@@ -1,6 +1,8 @@
+# yamllint disable rule:line-length
 ---
 name: General
-"on": pull_request
+"on":
+  pull_request:
 permissions:
   contents: read
   packages: read
@@ -15,7 +17,9 @@ jobs:
           - testing-type: yamllint
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.3
-      - uses: schubergphilis/mcvs-general-action@v0.5.8
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+      - uses: schubergphilis/mcvs-general-action@f52c4433add29d8eff9036bf37b5b69a2c4cf28b
         with:
           testing-type: ${{ matrix.args.testing-type }}

.github/workflows/golang.yml

@@ -16,7 +16,9 @@ jobs:
     env:
       TASK_X_REMOTE_TASKFILES: 1
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
       - uses: ./
         with:
           task-install: yes

.github/workflows/gomod-go-version-updater.yml

@@ -1,3 +1,4 @@
+# yamllint disable rule:line-length
 ---
 name: gomod-go-version-updater-action
 "on":
@@ -11,4 +12,4 @@ jobs:
   gomod-go-version-updater-action:
     runs-on: ubuntu-24.04
     steps:
-      - uses: schubergphilis/gomod-go-version-updater-action@v0.3.5
+      - uses: schubergphilis/gomod-go-version-updater-action@c12bc6c5e4ae85e82ee346115d1657e43121c195

.github/workflows/mcvs-pr-validation.yml

@@ -1,3 +1,4 @@
+# yamllint disable rule:line-length
 ---
 name: MCVS-PR-validation-action
 "on":
@@ -15,5 +16,7 @@ jobs:
   MCVS-PR-validation-action:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.3
-      - uses: schubergphilis/mcvs-pr-validation-action@v0.2.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
+      - uses: schubergphilis/mcvs-pr-validation-action@6f153c01301ab2f92336781173b7f3a796de5f3e

.github/workflows/package-version-updater.yml

@@ -10,7 +10,9 @@ jobs:
   update-package-version-not-updated-by-dependabot:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
       - env:
           DEPENDENCIES_LABEL: dependencies
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/stale.yml

@@ -11,7 +11,7 @@ jobs:
   stale:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/stale@v10.3.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899
         with:
           days-before-stale: 63
           days-before-close: 21

.github/workflows/taskfile-sorted-units.yml

@@ -9,7 +9,9 @@ jobs:
   taskfile-sorted-units:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
       - run: |
           check_sorted() {
             local task_name="$1"

.github/workflows/taskfile-without-empty-lines.yml

@@ -8,7 +8,9 @@ jobs:
   taskfile-without-empty-lines:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6.0.3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          persist-credentials: false
       - run: |
           yaml_file="./build/task.yml"
           empty_lines=$(grep -n -e '^$' "$yaml_file")