security: harden GitHub Actions and repository configuration

[timothyfroehlich]

Summary

• SHA-pin all actions: Pin ~70 action references to commit SHAs with version comments. Dependabot (already configured) keeps pins current via weekly PRs.
• persist-credentials: false: Added to all actions/checkout steps (fixes 20 zizmor artipacked findings).
• permissions: read-all: Set at workflow level for ci.yml, pr-screenshots.yml. Jobs needing writes declare explicitly.
• Harden-Runner (audit mode): step-security/harden-runner as first step in every CI job. Observe-only for now; follow-up bead PinPoint-oa6b to switch to block mode after one week.
• Zizmor + Pinact enforcement: Added to CI (Fast Linters job) and local pnpm run check:linters. Any unpinned action or workflow security issue fails CI.
• CODEOWNERS: Sensitive paths (.github/workflows/, supabase/, drizzle/, src/middleware.ts, src/lib/permissions/) require owner review.
• Cleanup: Deleted unused claude.yml workflow (had id-token: write), removed stale package-lock.json (17k-line npm lockfile in pnpm project causing false Dependabot alerts).

Test plan

• pnpm run check passes locally (all linters, unit tests, type checks)
• zizmor --min-severity low reports 0 findings
• pinact run --verify exits clean
• yamllint + actionlint pass on all workflow files
• CI Gate passes on this PR
• Verify Copilot review comments are addressed

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
pin-point	Ready	Preview, Comment	Mar 12, 2026 2:44am

[supabase]

Updates to Preview Branch (feat/github-hardening) ↗︎

Deployments	Status	Updated
Database	✅	Thu, 12 Mar 2026 02:42:50 UTC
Services	✅	Thu, 12 Mar 2026 02:42:50 UTC
APIs	✅	Thu, 12 Mar 2026 02:42:50 UTC

Tasks are run on every commit but only new migration files are pushed.
Close and reopen this PR if you want to apply changes from existing seed or migration files.

Tasks	Status	Updated
Configurations	✅	Thu, 12 Mar 2026 02:42:51 UTC
Migrations	✅	Thu, 12 Mar 2026 02:42:51 UTC
Seeding	✅	Thu, 12 Mar 2026 02:42:51 UTC
Edge Functions	✅	Thu, 12 Mar 2026 02:42:51 UTC

---

View logs for this Workflow Run ↗︎.
Learn more about Supabase for Git ↗︎.

[Copilot]

Pull request overview

Hardens the repository’s GitHub Actions posture by pinning action refs, tightening default workflow permissions, adding runner hardening, and enforcing workflow security checks in CI/local linting.

Changes:

• SHA-pin GitHub Actions uses: references and add persist-credentials: false to many actions/checkout steps.
• Add step-security/harden-runner (audit mode) broadly, and set workflow-level permissions: read-all for key workflows.
• Enforce workflow security via zizmor + pinact in CI and pnpm run check:linters; add CODEOWNERS for sensitive paths; remove unused .github/workflows/claude.yml.

Reviewed changes

Copilot reviewed 10 out of 12 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
package.json	Extends check:linters to include zizmor + pinact verification.
docs/superpowers/specs/2026-03-10-github-hardening-design.md	Adds design/spec for GitHub hardening approach and scope.
.gitignore	Ignores package-lock.json in a pnpm-managed repo.
.github/workflows/weekly-security-review.lock.yml	Normalizes pinned action version comments (no behavior change expected).
.github/workflows/weekly-changelog.lock.yml	Normalizes pinned action version comments (no behavior change expected).
.github/workflows/supabase-branch-setup.yaml	Pins actions used for Supabase preview branch setup.
.github/workflows/pr-screenshots.yml	Adds workflow-level read-only defaults, harden-runner, pins actions, and disables checkout credential persistence.
.github/workflows/cleanup-screenshots.yml	Adds harden-runner and pins checkout + disables credential persistence.
.github/workflows/claude.yml	Removes unused workflow with elevated permissions.
.github/workflows/ci.yml	Adds workflow-level permissions defaults, harden-runner everywhere, pins actions, and adds zizmor + pinact enforcement.
.github/CODEOWNERS	Requires owner review for sensitive paths (workflows, DB, auth/permissions).

[Copilot]

Pull request overview

Copilot reviewed 10 out of 12 changed files in this pull request and generated 2 comments.

---

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

This executes a remote script fetched from a floating branch (.../main/...) at CI runtime, which undermines the action-SHA pinning hardening goal and creates a supply-chain risk. Use a pinned commit URL for the script (or vendor it in-repo), and ideally add integrity verification (e.g., checksum/signature) for the downloaded actionlint binary/script.

Suggested change

	dl="https://raw.githubusercontent.com/rhysd/actionlint"
	dl="${dl}/main/scripts/download-actionlint.bash"
	# Use a pinned commit for the download-actionlint.bash script to avoid floating main branch
	dl="https://raw.githubusercontent.com/rhysd/actionlint/8de2549512de917fe01cfbc286f67ab83f255068/scripts/download-actionlint.bash"

[Copilot]

Using permissions: read-all plus suppressing zizmor’s excessive-permissions finding weakens the least-privilege posture. Since this workflow appears to need specific reads (e.g., likely checks: read for action-wait-for-check and contents: read for checkout), set explicit minimal scopes instead of read-all, and drop the ignore directive once scoped.

Suggested change

	permissions: read-all # zizmor: ignore[excessive-permissions]
	permissions:
	contents: read
	checks: read