feat(harden): analyze workflow files and cover Bundler cooldown - #86

What changed

• R-SEC-09 counts the workflow files when it establishes which languages an analyzer supports. Step 11 read as CodeQL over application code, so an agent following it reported a repository whose own language no analyzer supports as outside the rule, with nothing looking at its workflows.
• The GitHub reference names the two analyzers for those files. CodeQL's actions language has been generally available since April 2025, and default setup enables it only once workflow files sit on the default branch, while advanced setup needs actions in the matrix.
• The same section names zizmor beside it, pinned to zizmor-action v0.6.2, and maps its audits onto five rules this kit already owns: unpinned-uses, stale-action-refs, and impostor-commit onto R-SEC-01, excessive-permissions onto R-SEC-02, template-injection, github-env, and dangerous-triggers onto R-SEC-07, dependabot-cooldown onto R-SEC-14, and use-trusted-publishing onto R-PUB-02.
• The RubyGems reference gains an R-SEC-14 section for Bundler's own cooldown, which has existed since Bundler 4.0.13 and which no file here covered.
• It also gains an R-SEC-15 section. The rule places RubyGems outside itself because the ecosystem offers no way to decline a dependency's install-time code, and the reference now says so rather than leaving the exposure unmentioned.
• One correction to an existing claim, found while writing the cooldown section. The reference said bundle config set --local frozen true writes the setting where a reviewer and CI can read it.

Why this way

No new rule. STANDARD.md scores observable properties, and R-SEC-01, R-SEC-02, and R-SEC-07 already require what a workflow analyzer checks. A rule requiring the tool would fail a repository that pins by hand and satisfies all three, and would cost a rule-sources entry, a drift pass, and a site page for coverage R-SEC-09 already carries.

zizmor is a GitHub-side recommendation and references/gitlab.md gains nothing. It reads GitHub Actions, Dependabot, and pre-commit configurations, and does not read .gitlab-ci.yml.

The frozen correction shares a root cause with the cooldown section, so one fix covers both. bundle gem generates a .gitignore whose first line is /.bundle/. On a gem skeleton that file is committed nowhere, so the setting is invisible to a reviewer and absent from every checkout CI makes. That is also why the cooldown section prefers the Gemfile form to bundle config set cooldown.

Verification

Every Bundler claim comes from bundle install and bundle config on Bundler 4.0.17 and from the Bundler changelog, read locally rather than from a documentation site. That is where the 4.0.13 introduction, the three precedence layers, the created_at dependency, and the 4.0.15 lockfile exemption come from. The /.bundle/ ignore line was confirmed by generating a skeleton with bundle gem.

The zizmor-action v0.6.2 SHA was resolved through gh api repos/zizmorcore/zizmor-action/git/ref/tags/v0.6.2 and matches the SHA the action's own README publishes. The audit identifiers come from zizmor's audit reference, and the SARIF upload default and version: latest default from the action's README.

The BufferZoneCorp campaign was verified against Socket's research, which names extconf.rb as the install-time path.

Beyond the CI checks: node skills/oss-writing/scripts/prose.mjs over all four files reports 0 findings, the site builds 114 pages, and skillspector exits 0 with the same result as the base branch.

Known gaps

The version input still floats at latest in the snippet, which the prose names as a gap for the reader to close rather than pinning for them. Pinning it here would date the file at every zizmor release.

Affects