Update zizmor; switch to hash-pinned GitHub Actions

.github/workflows/build.yml

@@ -15,6 +15,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   build-debs:
     strategy:
@@ -28,10 +31,10 @@ jobs:
     outputs:
       artifact_id: ${{ steps.upload.outputs.artifact-id }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.versions.python }}
       - name: Build SecureDrop packages
@@ -43,7 +46,7 @@ jobs:
       - name: Build admin packages
         run: |
           OS_VERSION=${{ matrix.versions.ubuntu }} WHAT=admin ./builder/build-debs.sh
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         id: upload
         with:
           name: ${{ matrix.versions.ubuntu }}-${{ matrix.build }}
@@ -63,7 +66,7 @@ jobs:
         run: |
           apt-get update && apt-get install --yes diffoscope-minimal xz-utils \
             --no-install-recommends
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: "${{ matrix.ubuntu_version }}-*"
       - name: diffoscope

.github/workflows/cargo-vet.yml

@@ -9,6 +9,9 @@ on:
     types: ["opened", "synchronize"]
   merge_group:
 
+permissions:
+  contents: read
+
 jobs:
   cargo-vet:
     name: Vet Dependencies
@@ -18,10 +21,10 @@ jobs:
     env:
       CARGO_VET_VERSION: 0.10.2
     steps:
-    - uses: actions/checkout@v7.0.1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
-    - uses: actions/cache@v6.1.0
+    - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       id: cache-vet
       with:
         path: /usr/local/cargo/bin/cargo-vet

.github/workflows/ci.yml

@@ -12,6 +12,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
@@ -25,7 +28,7 @@ jobs:
       - name: Install Git
         run: |
           apt-get update && apt-get install --yes git
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install dependencies
@@ -52,7 +55,7 @@ jobs:
         ubuntu_version:
           - noble
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Build image
@@ -70,7 +73,7 @@ jobs:
         ubuntu_version:
           - noble
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Build image
@@ -88,7 +91,7 @@ jobs:
         ubuntu_version:
           - noble
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Build image
@@ -109,7 +112,7 @@ jobs:
     # Keep version in sync with rust-toolchain.toml
     container: rust:1.96.0
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install dependencies
@@ -124,7 +127,7 @@ jobs:
   admin-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Run tests

.github/workflows/demo-test.yml

@@ -12,6 +12,9 @@ defaults:
   run:
     shell: bash
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build Demo
@@ -29,11 +32,11 @@ jobs:
     env:
       DOCKERIZE_VERSION: v0.6.1
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Download artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ needs.build.outputs.artifact-name }}
       - name: Restore container image

.github/workflows/dependency-review.yml

@@ -9,8 +9,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v5.0.0
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/security.yml

@@ -8,13 +8,16 @@ on:
   schedule:
     - cron: '0 3 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   rust-audit:
     runs-on: ubuntu-latest
     # Keep version in sync with rust-toolchain.toml
     container: rust:1.96.0
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Check Rust dependencies
@@ -24,10 +27,10 @@ jobs:
   static-analysis:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.12'
       - name: Install dependencies

.github/workflows/staging.yml

@@ -7,6 +7,9 @@ on:
   schedule:
     - cron: '0 3 * * *'
 
+permissions:
+  contents: read
+
 jobs:
   staging:
     strategy:
@@ -18,7 +21,7 @@ jobs:
       GOOGLE_CREDENTIALS: ${{ secrets.GOOGLE_CREDENTIALS }}
       UBUNTU_VERSION: ${{ matrix.ubuntu_version }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Run staging tests on GCE

.github/workflows/translation.yml

@@ -13,6 +13,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !startsWith( github.ref, 'refs/heads/release/' ) }}
 
+permissions:
+  contents: read
+
 jobs:
   locales:
     runs-on: ubuntu-latest
@@ -21,7 +24,7 @@ jobs:
     env:
       GITHUB_ACTOR: ${{ github.actor }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Generate locale list
@@ -55,7 +58,7 @@ jobs:
     env:
       LOCALES: ${{ matrix.locale }}
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Build image
@@ -65,7 +68,7 @@ jobs:
         run: |
           make translation-test
       - name: Save screenshots
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: screenshots-${{ matrix.locale }}
           path: securedrop/tests/functional/pageslayout/screenshots/

.github/zizmor.yml

@@ -0,0 +1,10 @@
+rules:
+  cache-poisoning:
+    ignore:
+      # not used for releases / sensitive artifacts
+      - cargo-vet.yml
+  unpinned-uses:
+    config:
+      policies:
+        freedomofpress/actionslib/.github/workflows/oci-build.yaml: any
+        freedomofpress/actionslib/.github/workflows/update-k8s-trigger.yaml: any

securedrop/requirements/develop-requirements.in

@@ -39,4 +39,4 @@ pytest-testinfra>=5.3.1
 translate-toolkit
 uv>=0.11.15
 yamllint
-zizmor
+zizmor>=1.27

securedrop/requirements/develop-requirements.txt

@@ -1493,19 +1493,16 @@ zipp==3.23.0 \
     --hash=sha256:071652d6115ed432f5ce1d34c336c0adfd6a884660d1e9712a256d3d3bd4b14e \
     --hash=sha256:a07157588a12518c9d4034df3fbbee09c814741a33ff63c05fa29d26a2404166
     # via importlib-metadata
-zizmor==0.10.0 \
-    --hash=sha256:01743f434d8dacd3d4009999e92ddf2952c2138bfc10ab2eb1e2e592f31cb0a2 \
-    --hash=sha256:1c64fcd25149107aa6a5435fa2cf909b8fd92af2a7dfb8650aad59a1eb10f35e \
-    --hash=sha256:20eb70b037116ef29f4b90f298801f3cccb54f0a04e3454ae0ee31e70d554d77 \
-    --hash=sha256:4894141e6f0adb4821d377aad91cbcb699c88ae5c816267189926b2d40becdd3 \
-    --hash=sha256:514c5f0e104008884e4e0a2cdd1ad4cc63fc280791f43a8521f3fb96a7f264af \
-    --hash=sha256:7bbf8275ac411682200217a60a3f8ce8bf3b545ff9a1ea3c2d26436ad4ca81e1 \
-    --hash=sha256:7d74d430feb5c0a28fba3a200eac1ae6ce7e7ecbf593f386149f9c41fa02aeea \
-    --hash=sha256:85da4c1dd42b031aad3550024c6f9d2525668f04285b4280454c278153383e59 \
-    --hash=sha256:948eda1c8a33ac28946972f4672fddd09dd9ad793934b6f5d572b74acce1ec15 \
-    --hash=sha256:b88048c5b11af489ff37ff064fdd9a9cad6ea9cc34e8c25a9d2e196819859cf1 \
-    --hash=sha256:c9319af1c1806525aa18501488be2f9ba9f03b16ce8cb1c10e98b563e89aacfc \
-    --hash=sha256:d74ec6b1547f529756315238805fdfb58b59b09b6b7b85b49d38a68dc96aa706 \
-    --hash=sha256:ecac7a28aef6c7e058e0292da6f04345cfd21d36def7acff0038500544bd48c1 \
-    --hash=sha256:ffdacfddbb4eb4cbb0126e3875eb21a453414be47fe423824fdf1946fff9cc02
+zizmor==1.27.0 \
+    --hash=sha256:0bba3eff43f919b04b9b6365b4ef17437649e11eafb73f603407873b65ad01dd \
+    --hash=sha256:0de272b6c19910f5bc6965ac7d4566af26db31571e983e3b567298389d0c84c7 \
+    --hash=sha256:138e65d560e3875dbbbec50eae56a9e14707f8f4e006112174e4752155c01db9 \
+    --hash=sha256:90004342c3c5122d7e4e8e27ac6d3c462b878da0ea3d408ff45fa7d768139a76 \
+    --hash=sha256:afb28123882d2b8248f1e480bf6cc6d1af102e0d3fbe22a40f7f795b1aa9d435 \
+    --hash=sha256:b70697ebe555a28fbd3deaa259936f059f64b9f8531020f5b1f3d99087d4f62a \
+    --hash=sha256:cc94158472428e04298b879ef36cb94360b753ece38fa2303464dd7dae07bc68 \
+    --hash=sha256:debc723721172c170d5922171a40eaebf5787a02ff3e69d30597dafdb66a21ba \
+    --hash=sha256:e1042dd14fb4597a1e3007c7ef3f5a017305ca50cfacf43d603f3ae870c65eb1 \
+    --hash=sha256:fe8947f635c925b83ef83fcd66de5f89a012b22784bb86fcd7e2a1f4e7648c9d \
+    --hash=sha256:ffaf8e1bb39447e643592d669761bfbc2aa636875db9079614f6a6c81cec60c8
     # via -r requirements/develop-requirements.in