ci: add zizmor pre-commit hook

.github/workflows/issues.yml

@@ -20,6 +20,8 @@ jobs:
         with:
           client-id: ${{ secrets.POSIT_PLATFORM_CLIENT_ID }}
           private-key: ${{ secrets.POSIT_PLATFORM_PEM }}
+          permission-issues: write
+          permission-organization-projects: write
 
       - name: Add to Platform Carbon Project
         uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd  # v2.0.0

.github/workflows/product-release.yml

@@ -39,6 +39,8 @@ jobs:
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:

.github/zizmor.yml

@@ -7,3 +7,28 @@ rules:
         # defeat the purpose of reusable shared actions.
         "posit-dev/images-shared/*": ref-pin
         "*": hash-pin
+  artipacked:
+    ignore:
+      # Existing checkouts precede artifact uploads. Keep the exemptions scoped
+      # to these exact locations so new instances still require review.
+      - bakery-build-native.yml:145
+      - bakery-build-native.yml:242
+      - bakery-build-native.yml:427
+      - bakery-build-native.yml:563
+      - bakery-build-pr.yml:96
+      - bakery-build-pr.yml:208
+      - bakery-build.yml:131
+      - bakery-build.yml:220
+      - bakery-build.yml:386
+      - ci.yml:69
+      - ci.yml:248
+      - clean.yml:95
+      - clean.yml:141
+      - docs.yml:17
+      - hadolint.yml:39
+      - product-release.yml:45
+  superfluous-actions:
+    ignore:
+      # Replacing this established third-party action is outside this hook's
+      # scope; keep the exemption limited to the existing step.
+      - issues.yml:33

.pre-commit-config.yaml

@@ -49,3 +49,7 @@ repos:
     rev: v1.7.12
     hooks:
     -   id: actionlint
+-   repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.29.0
+    hooks:
+    -   id: zizmor

setup-bakery/action.yml

@@ -61,8 +61,10 @@ runs:
 
     - name: Install Bakery
       shell: bash
+      env:
+        VERSION: ${{ inputs.version }}
       run: |
-        uv tool install "git+https://github.com/posit-dev/images-shared.git@${{ inputs.version }}#subdirectory=posit-bakery&egg=posit-bakery"
+        uv tool install "git+https://github.com/posit-dev/images-shared.git@${VERSION}#subdirectory=posit-bakery&egg=posit-bakery"
 
     - name: Configure dependency version cache TTL
       shell: bash

setup-hadolint/action.yml

@@ -20,7 +20,9 @@ runs:
   steps:
     - name: Make tools directory
       shell: bash
-      run: mkdir -p "${{ inputs.base_path }}/tools"
+      env:
+        BASE_PATH: ${{ inputs.base_path }}
+      run: mkdir -p "${BASE_PATH}/tools"
     - name: Install hadolint
       shell: bash
       env: