[setchy]

Summary

• Use a discoverable .github/zizmor.yml policy that requires hash-pin for actions, with only the exact trusted Renovate validator reusable-workflow path allowed to use ref-pin.
• Move the Renovate validator call from its stale commit SHA and misleading # main comment to @main.
• Set contents: read on the calling job because the shared reusable workflow checks out the consumer repository; this keeps the validator at least privilege.

Rollout dependency

Merge gitify-app/renovate-config#20 first. electron-menubar inherits the shared preset; no duplicate local pinDigests rule is added.

Validation

• zizmor 1.31.1 reports no findings on the changed validator workflow and no unpinned-uses finding for its trusted ref.
• Comparing the full zizmor scan to the unchanged workflow baseline shows all other findings are unchanged: 33 unpinned action findings, one dangerous-triggers finding, and one self-repository finding.
• Ruby YAML parser: all workflow, config, and lock YAML files parse.
• gh actions-lock --verify and --verify-local: all workflows have complete lockfile coverage; third-party workflow refs and the lockfile are unchanged from main.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud