chore: add zizmor (#10)

Signed-off-by: Keith Zantow <kzantow@gmail.com>

Author: kzantow

.github/dependabot.yaml

@@ -8,6 +8,8 @@ updates:
       - "/.make"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
@@ -16,6 +18,8 @@ updates:
     directory: "/"
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 10
     labels:
       - "dependencies"

.github/workflows/oss-project-board-add.yaml

@@ -8,6 +8,9 @@ on:
       - transferred
       - labeled
 
+permissions:
+  contents: read
+
 jobs:
 
   run:

.github/workflows/remove-awaiting-response-label.yaml

@@ -4,6 +4,9 @@ on:
   issue_comment:
     types: [created]
 
+permissions:
+  contents: read
+
 jobs:
   run:
     uses: "anchore/workflows/.github/workflows/remove-awaiting-response-label.yaml@main"

.github/workflows/validate-github-actions.yaml

@@ -0,0 +1,35 @@
+name: "Validate GitHub Actions"
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+      - '.github/actions/**'
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/workflows/**'
+      - '.github/actions/**'
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: "Lint"
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: "Run zizmor"
+        uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
+        with:
+          config: .github/zizmor.yml
+          # Disable SARIF upload so the step is a simple pass/fail gate
+          advanced-security: false
+          inputs: .github

.github/workflows/validations.yml

@@ -15,6 +15,9 @@ on:
   schedule:
     - cron: '0 2 15 * *' # monthly at 2 am on the 15th
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:

.github/zizmor.yml

@@ -0,0 +1,6 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # anchore actions are internal; using @main is acceptable
+        anchore/*: any