From 3ebc8ed809c0e739e3108f4912e683a0c8595d6a Mon Sep 17 00:00:00 2001
From: Yuki Okushi <huyuumi.dev@gmail.com>
Date: Wed, 29 Apr 2026 19:20:19 +0900
Subject: [PATCH] chore: use zizmor to harden GHA usage

---
 .github/dependabot.yml           |  4 ++++
 .github/workflows/ci-nightly.yml |  5 +++++
 .github/workflows/ci.yml         |  5 +++++
 .github/workflows/clippy-fmt.yml | 26 ++++++++++++++++++++++++++
 zizmor.yml                       |  4 ++++
 5 files changed, 44 insertions(+)
 create mode 100644 zizmor.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b6c30fba..19e72db0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,10 +4,14 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 3
   - package-ecosystem: cargo
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 3
     versioning-strategy: lockfile-only
     groups:
       aws:
diff --git a/.github/workflows/ci-nightly.yml b/.github/workflows/ci-nightly.yml
index c96f325e..20887b85 100644
--- a/.github/workflows/ci-nightly.yml
+++ b/.github/workflows/ci-nightly.yml
@@ -5,6 +5,9 @@ on:
 
 jobs:
   build_and_test:
+    permissions:
+      contents: read
+
     strategy:
       fail-fast: false
       matrix:
@@ -15,6 +18,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install Rust (${{ matrix.version }})
         uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 466904a3..4b803493 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,6 +10,9 @@ on:
 
 jobs:
   build_and_test:
+    permissions:
+      contents: read
+
     strategy:
       fail-fast: false
       matrix:
@@ -20,6 +23,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install Rust (${{ matrix.version }})
         uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
diff --git a/.github/workflows/clippy-fmt.yml b/.github/workflows/clippy-fmt.yml
index 0f8c2aa1..c676fdf7 100644
--- a/.github/workflows/clippy-fmt.yml
+++ b/.github/workflows/clippy-fmt.yml
@@ -5,12 +5,34 @@ on:
     types: [opened, synchronize, reopened]
 
 jobs:
+  zizmor:
+    name: zizmor
+    permissions:
+      actions: read
+      contents: read
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          advanced-security: false
+          annotations: true
+          version: v1.24.1
+
   fmt:
     name: rustfmt check
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install Rust
         uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
@@ -23,6 +45,8 @@ jobs:
 
   clippy:
     name: clippy check
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
 
     env:
@@ -31,6 +55,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Install Rust
         uses: actions-rust-lang/setup-rust-toolchain@2b1f5e9b395427c92ee4e3331786ca3c37afe2d7 # v1.16.0
diff --git a/zizmor.yml b/zizmor.yml
new file mode 100644
index 00000000..bfd32c72
--- /dev/null
+++ b/zizmor.yml
@@ -0,0 +1,4 @@
+rules:
+  dependabot-cooldown:
+    config:
+      days: 3