fix(ci): pin actions/checkout v7 for Super-linter

.github/workflows/bash-tests.yml

@@ -23,10 +23,15 @@ jobs:
     name: ShellCheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout code
+        # actions/checkout v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
 
       - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@2.0.0
+        # ludeeus/action-shellcheck 2.0.0
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38
         with:
           scandir: "."
           severity: warning
@@ -35,7 +40,11 @@ jobs:
     name: Syntax Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout code
+        # actions/checkout v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
 
       - name: Check bash syntax
         run: |
@@ -62,7 +71,11 @@ jobs:
       matrix:
         bash-version: ["4.4", "5.0", "5.1", "5.2"]
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout code
+        # actions/checkout v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
 
       - name: Test with bash version
         env:
@@ -91,10 +104,15 @@ jobs:
     name: Unit Tests (bats)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout code
+        # actions/checkout v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
 
       - name: Setup bats
-        uses: bats-core/bats-action@4.0.0
+        # bats-core/bats-action 4.0.0
+        uses: bats-core/bats-action@77d6fb60505b4d0d1d73e48bd035b55074bbfb43
 
       - name: Run bats tests
         run: |
@@ -104,4 +122,3 @@ jobs:
             echo "No bats tests found in tests/ directory"
             echo "Skipping unit tests"
           fi
-

.github/workflows/pr-automation.yml

@@ -13,26 +13,26 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        # actions/checkout v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
 
       - name: Get changed files
         id: changed-files
         run: |
-          # Get list of changed files
           FILES=$(gh pr diff "$PR_NUMBER" --name-only)
-          echo "files<<EOF" >> $GITHUB_OUTPUT
-          echo "$FILES" >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
+          {
+            echo "files<<EOF"
+            echo "$FILES"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Auto-label based on files
         run: |
-          PR_NUMBER=${{ github.event.pull_request.number }}
-          FILES="${{ steps.changed-files.outputs.files }}"
-
-          # Area labels based on file paths
           if echo "$FILES" | grep -q "^src/api/\|^api/"; then
             gh pr edit "$PR_NUMBER" --add-label "area:api" || true
           fi
@@ -53,27 +53,23 @@ jobs:
             gh pr edit "$PR_NUMBER" --add-label "area:tests" || true
           fi
 
-          # Check for breaking changes in commits
-          COMMITS=$(gh api repos/${{ github.repository }}/pulls/$PR_NUMBER/commits --jq '.[].commit.message' | grep -i "BREAKING CHANGE" || true)
+          COMMITS=$(gh api "repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/commits" --jq '.[].commit.message' | grep -i "BREAKING CHANGE" || true)
           if [ -n "$COMMITS" ]; then
             gh pr edit "$PR_NUMBER" --add-label "type:breaking" || true
           fi
 
-          # Documentation only
           if echo "$FILES" | grep -v "^docs/\|\.md$" | grep -q .; then
             :
           else
             gh pr edit "$PR_NUMBER" --add-label "documentation" || true
           fi
         env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          FILES: ${{ steps.changed-files.outputs.files }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Auto-assign reviewers based on files
         run: |
-          PR_NUMBER=${{ github.event.pull_request.number }}
-          FILES="${{ steps.changed-files.outputs.files }}"
-
-          # Assign reviewers based on code areas
           if echo "$FILES" | grep -q "^src/frontend/\|^components/\|^ui/"; then
             gh pr edit "$PR_NUMBER" --add-reviewer "frontend-team" || true
           fi
@@ -90,14 +86,12 @@ jobs:
             gh pr edit "$PR_NUMBER" --add-reviewer "devops-team" || true
           fi
         env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          FILES: ${{ steps.changed-files.outputs.files }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Welcome first-time contributors
         run: |
-          PR_NUMBER=${{ github.event.pull_request.number }}
-          AUTHOR=${{ github.event.pull_request.user.login }}
-
-          # Check if this is the author's first PR
           PR_COUNT=$(gh pr list --author "$AUTHOR" --state all --limit 1 --json number --jq 'length')
 
           if [ "$PR_COUNT" -eq 1 ]; then
@@ -120,4 +114,6 @@ jobs:
             Thanks again for contributing! 🎉'
           fi
         env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          AUTHOR: ${{ github.event.pull_request.user.login }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -3,7 +3,7 @@ name: Release
 on:
   push:
     tags:
-      - 'v*'
+      - "v*"
   workflow_dispatch:
 
 permissions:
@@ -15,18 +15,21 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        # actions/checkout v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        with:
+          persist-credentials: false
 
       - name: Extract version from tag
         id: get_version
-        run: echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
+        run: echo "version=${GITHUB_REF#refs/tags/v}" >> "$GITHUB_OUTPUT"
 
       - name: Generate release notes
         id: release_notes
+        env:
+          VERSION: ${{ steps.get_version.outputs.version }}
         run: |
-          # Extract changes for this version from CHANGELOG
-          VERSION="${{ steps.get_version.outputs.version }}"
-          echo "## What's Changed\n" > release_notes.md
+          printf '%s\n\n' "## What's Changed" > release_notes.md
 
           if grep -A 50 "## \[$VERSION\]" CHANGELOG.md; then
             sed -n "/## \[$VERSION\]/,/## /p" CHANGELOG.md | sed '$d' | sed '1d' >> release_notes.md
@@ -36,8 +39,9 @@ jobs:
 
           cat release_notes.md
 
-      - name: Create GitHub Release
-        uses: softprops/action-gh-release@v3
+      - name: Create GitHub Release # zizmor: ignore[superfluous-actions]
+        # softprops/action-gh-release v3.0.3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64
         with:
           tag_ref: ${{ github.ref }}
           name: Release ${{ steps.get_version.outputs.version }}

clickhouse/.github/workflows/sync-rules.yml

@@ -1,9 +1,9 @@
 name: Sync Rules from ClickHouse/agent-skills
 
 on:
-  workflow_dispatch:  # Allow manual trigger
+  workflow_dispatch:
   schedule:
-    - cron: '0 0 * * 0'  # Run weekly on Sunday at midnight UTC
+    - cron: "0 0 * * 0" # Run weekly on Sunday at midnight UTC
 
 permissions:
   contents: write
@@ -14,58 +14,58 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout this repository
-        uses: actions/checkout@v6
+        # actions/checkout v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: false
 
       - name: Checkout ClickHouse/agent-skills
-        uses: actions/checkout@v6
+        # actions/checkout v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           repository: ClickHouse/agent-skills
           path: agent-skills
           ref: main
+          persist-credentials: false
 
       - name: Copy rule files
         run: |
-          # Copy all rule files from agent-skills to our skill directory
           cp -r agent-skills/skills/clickhouse-best-practices/rules/* skills/clickhouse/rules/
 
       - name: Update version
         run: |
-          # Increment patch version in SKILL.md
           current_version=$(grep 'Version.*' skills/clickhouse/SKILL.md | head -1 | sed 's/.*Version.*: \([0-9.]*\).*/\1/')
           echo "Current version: $current_version"
 
-          # Increment patch version
           IFS='.' read -r major minor patch <<< "$current_version"
           new_patch=$((patch + 1))
           new_version="$major.$minor.$new_patch"
           echo "New version: $new_version"
 
-          # Update SKILL.md
           sed -i "s/\*\*Version\*\*: $current_version/\*\*Version\*\*: $new_version/" skills/clickhouse/SKILL.md
 
-          # Update plugin.json
           sed -i "s/\"version\": \"$current_version\"/\"version\": \"$new_version\"/" .claude-plugin/plugin.json
 
       - name: Check for changes
         id: check-changes
         run: |
           if git diff --quiet; then
-            echo "has_changes=false" >> $GITHUB_OUTPUT
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
           else
-            echo "has_changes=true" >> $GITHUB_OUTPUT
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Create Pull Request
         if: steps.check-changes.outputs.has_changes == 'true'
-        uses: peter-evans/create-pull-request@v8
+        # peter-evans/create-pull-request v8.1.1
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          commit-message: 'feat(clickhouse): sync rules from ClickHouse/agent-skills'
+          commit-message: "feat(clickhouse): sync rules from ClickHouse/agent-skills"
           committer: GitHub <noreply@github.com>
           author: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
-          title: 'feat(clickhouse): sync rules from ClickHouse/agent-skills'
+          title: "feat(clickhouse): sync rules from ClickHouse/agent-skills"
           body: |
             ## Sync from ClickHouse/agent-skills