chore(ci): switch to jactionlint v2 and drop zizmor

.github/workflows/aube-lock.yml

@@ -9,11 +9,18 @@ on:
   push:
     branches: ["renovate/**"]
 
-permissions:
-  contents: write
+# "-caller" keeps this group apart from the one the shared workflow sets for
+# its own job (aube-lock-<ref>); equal groups would cancel the called job.
+concurrency:
+  group: ${{ github.workflow }}-caller-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
 
 jobs:
   aube-lock:
+    permissions:
+      contents: write
     uses: jdx/renovate-config/.github/workflows/aube-lock.yml@d0f85cba63adc5a26194009e76eebcf5bc1ee823 # v1.0.2
     secrets:
       AUBE_LOCK_APP_ID: ${{ secrets.AUBE_LOCK_APP_ID }}

.github/workflows/comment-release-fixes.yml

@@ -11,6 +11,9 @@ on:
           },
       },
   }
+concurrency:
+  group: ${{ github.workflow }}-${{ inputs.tag || github.event.release.tag_name }}
+  cancel-in-progress: false
 jobs:
   comment:
     permissions:

.github/workflows/draft-limit.yml

@@ -8,8 +8,12 @@ on:
   # Fork pull requests only get a write token under pull_request_target, which
   # the shared workflow needs to comment and close. It never checks out or runs
   # the pull request's code.
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
+  # jactionlint ignore=dangerous-triggers
+  pull_request_target:
     types: [opened, reopened, converted_to_draft]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 permissions: {}
 

.github/workflows/link-discussion.yml

@@ -3,11 +3,15 @@ name: link-discussion
 on:
   pull_request:
     types: [closed]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   link-discussion:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     permissions:
       discussions: write
       pull-requests: read

.github/workflows/mise-lock.yml

@@ -13,6 +13,12 @@ on:
   push:
     branches: ["renovate/**"]
 
+# "-caller" keeps this group apart from the one the shared workflow sets for
+# its own job (mise-lock-<ref>); equal groups would cancel the called job.
+concurrency:
+  group: ${{ github.workflow }}-caller-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:

.github/workflows/perf-pr-preflight.yml

@@ -3,12 +3,16 @@ name: perf-pr-preflight
 on:
   pull_request:
     types: [opened, synchronize, reopened]
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 permissions:
   contents: read
 
 jobs:
   complete:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - run: echo "The default-branch controller will independently validate this pull request."

.github/workflows/perf-pr.yml

@@ -13,7 +13,9 @@ name: perf-pr
 # and discarded with the runner. Only main contributes to the persistent history —
 # a branch's numbers are not the trunk's, and a series that mixes them cannot be read.
 
-on: # zizmor: ignore[dangerous-triggers] validates live PR metadata before any self-hosted job
+# validates live PR metadata before any self-hosted job
+# jactionlint ignore=dangerous-triggers
+on:
   workflow_run:
     workflows: [perf-pr-preflight]
     types: [completed]
@@ -35,6 +37,7 @@ env:
 jobs:
   authorize:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     outputs:
       authorized: ${{ steps.pr.outputs.authorized }}
       base_ref: ${{ steps.pr.outputs.base_ref }}
@@ -272,6 +275,7 @@ jobs:
           GH_usage: ${{ github.repository }}
           PR_NUMBER: ${{ needs.authorize.outputs.pr_number }}
         run: |
+          set -o pipefail
           marker='<!-- usage-perf-pr -->'
           read -r head_sha base_sha < /tmp/tak-out/shas
           # The backticks below are markdown, not command substitution, and
@@ -315,6 +319,7 @@ jobs:
           HEAD_SHA: ${{ needs.authorize.outputs.head_sha }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         run: |
+          set -o pipefail
           status=$(cat /tmp/tak-out/status 2>/dev/null || echo 2)
           if [ "$status" -eq 0 ]; then
             conclusion=success

.github/workflows/perf.yml

@@ -133,6 +133,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REPOSITORY: ${{ github.repository }}
         run: |
+          set -o pipefail
           sha=$(cat /tmp/tak-out/sha)
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"

.github/workflows/release-plz.yml

@@ -1,9 +1,6 @@
 name: release-plz
 
-permissions:
-  pull-requests: write
-  contents: write
-  id-token: write
+permissions: {}
 
 on:
   workflow_dispatch:
@@ -22,6 +19,10 @@ concurrency:
 
 jobs:
   release-plz:
+    permissions:
+      pull-requests: write
+      contents: write
+      id-token: write
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:

.github/workflows/size.yml

@@ -35,7 +35,7 @@ jobs:
           # `tasks/size.sh` builds the merge base from a worktree.
           fetch-depth: 0
           persist-credentials: false
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # zizmor: ignore[cache-poisoning]
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: size
       # The report reaches the job summary whether or not the gate passed, and the exit

.github/workflows/test-impl.yml

@@ -6,9 +6,8 @@ on:
         required: true
         type: boolean
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+permissions:
+  contents: read
 
 env:
   MBX_DISABLE: "1"
@@ -26,7 +25,7 @@ jobs:
           submodules: recursive
           persist-credentials: false
       - uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # zizmor: ignore[cache-poisoning]
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: test
           save-if: ${{ inputs.trusted && github.ref == 'refs/heads/main' }}
@@ -130,7 +129,11 @@ jobs:
             git diff
             exit 1
           fi
+      # Online checks run in CI only; locally: JACTIONLINT_ONLINE=1 hk check --all
       - run: mise r lint
+        env:
+          JACTIONLINT_ONLINE: 1
+          GITHUB_TOKEN: ${{ github.token }}
 
   # The only job that is not Linux, and for several `cfg` branches the only place they are
   # compiled at all. The argv path planner, the config path normaliser and
@@ -151,7 +154,7 @@ jobs:
           submodules: recursive
           persist-credentials: false
       - uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5 # v5.0.0
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # zizmor: ignore[cache-poisoning]
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: test-windows
           save-if: ${{ inputs.trusted && github.ref == 'refs/heads/main' }}
@@ -257,7 +260,7 @@ jobs:
         with:
           cache: false
           install_args: mr-boxington
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2 # zizmor: ignore[cache-poisoning]
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           shared-key: msrv-${{ matrix.version }}
           save-if: ${{ inputs.trusted && github.ref == 'refs/heads/main' }}

.github/workflows/test.yml

@@ -5,6 +5,12 @@ on:
     branches: ["main"]
   pull_request:
 
+# Held by the caller, which only calls test-impl.yml: a group set inside the
+# called workflow would use this workflow's name too and wait for this run.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
@@ -24,38 +30,19 @@ jobs:
     with:
       trusted: false
 
-  zizmor:
-    name: zizmor
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
-        with:
-          advanced-security: false
-
   final:
     name: final
     if: ${{ always() && !cancelled() && needs.trusted.result != 'cancelled' && needs.untrusted.result != 'cancelled' }}
     permissions: {}
-    needs: [trusted, untrusted, zizmor]
+    needs: [trusted, untrusted]
     runs-on: ubuntu-latest
     timeout-minutes: 1
     steps:
       - name: Check selected workflow result
         env:
           TRUSTED_RESULT: ${{ needs.trusted.result }}
           UNTRUSTED_RESULT: ${{ needs.untrusted.result }}
-          ZIZMOR_RESULT: ${{ needs.zizmor.result }}
         run: |
-          if [[ "$ZIZMOR_RESULT" != success ]]; then
-            echo "zizmor=$ZIZMOR_RESULT"
-            exit 1
-          fi
           if [[ "$TRUSTED_RESULT" == success && "$UNTRUSTED_RESULT" == skipped ]] ||
              [[ "$TRUSTED_RESULT" == skipped && "$UNTRUSTED_RESULT" == success ]]; then
             exit 0

hk.pkl

@@ -37,14 +37,18 @@ local linters = new Mapping<String, Step> {
     ["go-fix"] = Builtins.go_fix
     ["go-mod-tidy"] = Builtins.gomod_tidy
 
-    // lints GitHub Actions workflows (jdx/jactionlint, a maintained actionlint fork)
+    // lints GitHub Actions workflows (jdx/jactionlint, security and policy linter for workflows)
     ["jactionlint"] {
-        glob = List(".github/workflows/*.yml", ".github/workflows/*.yaml")
+        glob = List(".github/workflows/*.yml", ".github/workflows/*.yaml", ".github/actions/**/action.yml", ".github/actions/**/action.yaml", ".github/dependabot.yml", ".github/dependabot.yaml")
         batch = true
         check = new CommandSpec {
             command = "jactionlint {{ files }}"
             effect = "read"
         }
+        fix = new CommandSpec {
+            command = "jactionlint --fix {{ files }}"
+            effect = "write"
+        }
     }
 
     ["rust-docs-version"] {