From 755190ad88fb27e2b053c8ea6a4904ffb3661ec8 Mon Sep 17 00:00:00 2001
From: Sebastian Mendel <github@sebastianmendel.de>
Date: Sun, 2 Aug 2026 09:40:34 +0200
Subject: [PATCH] ci: add secret and workflow scanning to security.yml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Brings security.yml to the current netresearch/.github skill-template revision
and adds the shared zizmor config.

What changes:
- adds the zizmor job (static analysis of this repo's GitHub Actions workflows)
- drops the GITLEAKS_LICENSE secret mapping: secret scanning runs on
  betterleaks, which is OSS, and the org-level secret no longer exists
- adds top-level `permissions: {}` plus an explicit permission set per caller
  job, so no job relies on the repository default
- narrows the triggers from [main, master] to [main] (this repo's default
  branch is main)
- adds the composer-audit permissions block

`.github/zizmor.yml` exempts first-party netresearch/* reusables from the
blanket hash-pin policy — they track @main by convention — while third-party
actions stay hash-pin enforced. Without it the two new caller lines flag
themselves.

This repo is not wired into the template drift check and this change does not
wire it in: only the two files above are touched.

Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
---
 .github/workflows/security.yml | 31 +++++++++++++++++++++++++++----
 .github/zizmor.yml             | 13 +++++++++++++
 2 files changed, 40 insertions(+), 4 deletions(-)
 create mode 100644 .github/zizmor.yml

diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 1010656..fcf498e 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -1,16 +1,36 @@
 name: Security
 
+# Aggregated security scans for skill repos: secret scanning (betterleaks),
+# workflow static analysis (zizmor), dependency review on PRs, and a composer
+# audit (every skill repo ships a composer.json for split-licensing /
+# Packagist distribution).
+#
+# Top-level `permissions: {}` denies everything by default; each reusable
+# caller job re-declares the exact union its reusable's jobs require, so the
+# token passed to each reusable is fully explicit and never relies on the
+# repo default. This is the same pattern proven in netresearch/.github's
+# go-app template (top {} + per-job security-events: write).
+
 on:
   push:
-    branches: [main, master]
+    branches: [main]
   pull_request:
-    branches: [main, master]
+    branches: [main]
+
+permissions: {}
 
 jobs:
   gitleaks:
     uses: netresearch/.github/.github/workflows/gitleaks.yml@main
-    secrets:
-      GITLEAKS_LICENSE: ${{ secrets.GITLEAKS_LICENSE }}
+    permissions:
+      contents: read
+      security-events: write
+
+  zizmor:
+    uses: netresearch/.github/.github/workflows/zizmor.yml@main
+    permissions:
+      contents: read
+      security-events: write
 
   dependency-review:
     if: github.event_name == 'pull_request'
@@ -21,3 +41,6 @@ jobs:
 
   composer-audit:
     uses: netresearch/typo3-ci-workflows/.github/workflows/security.yml@main
+    permissions:
+      contents: read
+      security-events: write
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..b9d8464
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,13 @@
+# zizmor (https://zizmor.sh) configuration
+#
+# Tunes zizmor to Netresearch conventions so the audit reports only
+# actionable findings. Third-party actions remain hash-pin enforced.
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # First-party reusable workflows track @main by policy and are
+        # never SHA-pinned, so fixes propagate to all consumers.
+        "netresearch/*": ref-pin
+        # Everything else must be pinned to a full commit SHA.
+        "*": hash-pin