ci(workflows): add zizmor audit and harden workflows

[Copilot]

• Add zizmor audit workflow and config
• Harden expression injection across workflows
• Scope app token permissions explicitly
• Add deploy-test-studio permissions
• Add lint:workflows script
• Replace secrets: inherit with explicit secrets in changesets workflow
• Update zizmor ignore annotation text
• Fix knip check by adding zizmor to ignoreBinaries

[changeset-bot]

⚠️ No Changeset found

Latest commit: 6bbd399

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
plugins-studio	Ready	Preview, Comment	May 15, 2026 9:03am

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github/​zizmorcore/​zizmor-action@​b1d7e1fb5de872772f31590499237e7cce841e8e

View full report

[pedrobonamin]

@copilot
Replace secrets: inherit with explicit pass-through

The reusable workflow only declares two required secrets (ECOSPARK_APP_ID and ECOSPARK_APP_PRIVATE_KEY). Forward only those:

secrets:
ECOSPARK_APP_ID: ${{ secrets.ECOSPARK_APP_ID }}
ECOSPARK_APP_PRIVATE_KEY: ${{ secrets.ECOSPARK_APP_PRIVATE_KEY }}

[Copilot]

Done in c9be512 — replaced secrets: inherit with explicit pass-through of ECOSPARK_APP_ID and ECOSPARK_APP_PRIVATE_KEY.

[pedrobonamin]

@copilot knip check is failing due to zizmor, configure knip so it ignores zizmor

Run pnpm knip --reporter github-actions

> plugins-monorepo@1.0.0 knip /home/runner/work/plugins/plugins
> knip --reporter github-actions

Unlisted binaries (1)
Error: zizmor in package.json
Unused catalog entries (1)
Warning: @sanity/vision in pnpm-workspace.yaml
 ELIFECYCLE  Command failed with exit code 1.
Error: Process completed with exit code 1.
`

[Copilot]

@copilot knip check is failing due to zizmor, configure knip so it ignores zizmor

...

Fixed in 6bbd399 — added "zizmor" to ignoreBinaries in knip.jsonc root workspace config.

[Copilot]

Pull request overview

Hardens GitHub Actions workflows against expression injection and over-privileged tokens by moving untrusted inputs into env vars, scoping actions/create-github-app-token permissions, and replacing secrets: inherit with explicit secret passthrough. Adds a new zizmor audit workflow plus a lint:workflows script for local runs.

Changes:

• New zizmor.yml config and .github/workflows/zizmor.yml workflow (pinned action, empty top-level permissions, persist-credentials: false).
• Across many workflows: replace ${{ ... }} interpolation in run: blocks with environment-variable indirection; scope app-token permissions to contents: write and pull-requests: write; add permissions: contents: read to deploy-test-studio.yml.
• changesets-from-conventional-commits.yml: replace secrets: inherit with explicit secrets and add a zizmor: ignore annotation justifying pull_request_target.
• package.json adds lint:workflows script; knip.jsonc adds zizmor to ignoreBinaries.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
zizmor.yml	New zizmor rules config restricting unpinned uses by owner.
.github/workflows/zizmor.yml	New audit workflow running zizmor at high severity.
.github/workflows/ci.yml	Move github.base_ref into env to avoid expression injection in run.
.github/workflows/pkg-pr-new.yml	Same env-indirection treatment for base_ref and computed package_paths.
.github/workflows/deploy-test-studio.yml	Add minimal contents: read permissions block.
.github/workflows/setup-trusted-publish.yml	Move inputs.package into env for shell steps.
.github/workflows/lint-fix-if-needed.yml	Scope app-token perms; env-indirect PR number for gh pr merge.
.github/workflows/pnpm-if-needed.yml	Same scoping/env-indirection pattern.
.github/workflows/typegen.yml	Same scoping/env-indirection pattern.
.github/workflows/update-skills-if-needed.yml	Same scoping/env-indirection pattern.
.github/workflows/renovate.yml	Scope app-token permissions.
.github/workflows/changesets-from-conventional-commits.yml	Annotate pull_request_target; pass secrets explicitly.
package.json	Add lint:workflows script invoking zizmor if installed.
knip.jsonc	Whitelist external zizmor binary.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[bjoerge]

I'm not familiar enough with the existing setup to verify the validity of this