ci: harden GitHub Actions workflows (#73)

* Pin GitHub Actions to SHA hashes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Address zizmor warnings: artipacked and excessive-permissions

- Add persist-credentials: false to checkout steps (artipacked)
- Add permissions: {} at workflow level and contents: read per job (excessive-permissions)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Suppress unpinned-images for service container images

Version tags already pin to specific releases; digest pinning for
multi-arch images is nontrivial.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add lint-actions CI job for actionlint and zizmor

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Configure dependabot for GitHub Actions with weekly batched updates

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Update unpinned-images suppression comments

Use more accurate wording that doesn't imply Docker tags are immutable.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: flavorjones

.github/dependabot.yml

@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/build.yml

@@ -5,24 +5,49 @@ on:
   pull_request:
     types: [ opened, synchronize ]
 
+permissions: {}
+
 jobs:
   rubocop:
     name: Rubocop
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
       - name: Setup Ruby and install gems
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
         with:
           ruby-version: '4.0'
           bundler-cache: true
       - name: Run rubocop
         run: |
           bundle exec rubocop --parallel
+  lint-actions:
+    name: GitHub Actions audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run actionlint
+        uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        with:
+          advanced-security: false
   tests:
     name: Ruby ${{ matrix.ruby-version }}, ${{ matrix.rails-version }}, ${{ matrix.database }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -32,7 +57,7 @@ jobs:
     continue-on-error: ${{ matrix.rails-version == 'rails_edge' }}
     services:
       postgres:
-        image: postgres:16
+        image: postgres:16 # zizmor: ignore[unpinned-images] -- version tag is fine for service containers
         env:
           POSTGRES_HOST_AUTH_METHOD: "trust"
         options: >-
@@ -43,7 +68,7 @@ jobs:
         ports:
           - 55433:5432
       mysql:
-        image: mysql:8.0
+        image: mysql:8.0 # zizmor: ignore[unpinned-images] -- version tag is fine for service containers
         env:
           MYSQL_ALLOW_EMPTY_PASSWORD: "yes"
         options: >-
@@ -58,9 +83,11 @@ jobs:
       TARGET_DB: ${{ matrix.database }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
       - name: Setup Ruby and install gems
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@319994f95fa847cf3fb3cd3dbe89f6dcde9f178f # v1.295.0
         with:
           ruby-version: ${{ matrix.ruby-version }}
           bundler-cache: true