ci: harden CI/CD security (SHA-pin actions, pnpm 11, zizmor, permissions)

[AlemTuzlak]

Summary

Resolves M-13 from the CI/CD Supply Chain Security Audit (deferred SHA-pinning) and aligns aimock with TanStack's post-incident hardening playbook. Codeowners excluded — already present.

Full write-up: aimock CI/CD Hardening — Notion.

What changed

• SHA-pinned every third-party action across all 13 workflows. Each uses: action@v* becomes uses: action@<40-char-sha> # <tag> — immutable, Dependabot-bumpable. Pinned to the latest patch within each current major (no silent major bumps).
• pnpm 10.28.2 → 11.1.2. pnpm 11 blocks lifecycle scripts by default. New pnpm-workspace.yaml allowlists esbuild, protobufjs, unrs-resolver with comments explaining why each is trusted. Any future dep that ships a postinstall will fail loud.
• Added zizmor. New .github/workflows/zizmor.yml runs on PR/push for .github/** changes at min-severity: medium. .github/zizmor.yml config allowlists 5 intentional patterns (3 push-back checkouts, 2 dangerous-triggers cases) with per-rule justifications inline.
• Tightened GITHUB_TOKEN permissions on the 8 workflows that lacked top-level permissions: blocks. Default-deny with contents: read; jobs grant only what they need. notify-issue.yml / notify-pr.yml get permissions: {} (zero scope). Added persist-credentials: false to every checkout that doesn't push back.
• Agent-audit fixes folded in:
  • static-quality.yml commitlint — moved PR base/head SHAs into env: (script-injection)
  • fix-drift.yml — gated verify + PR-creation on steps.autofix.outcome == 'success' (silent-failure mode prevented)
  • publish-docker.yml — scoped buildx GHA cache by event (pr-<num> vs release) to prevent PR-to-release cache poisoning
  • publish-release.yml — added top-level permissions: contents: read
  • publish-release.yml / update-competitive-matrix.yml / fix-drift.yml — moved several secrets.* interpolations from run: bodies into env: blocks

Deferred (need wider discussion)

• HIGH — fix-drift.yml clones ag-ui:main HEAD then runs Claude Code with a write-scoped token. Prompt-injection surface. Mitigations all change drift-detection semantics.
• HIGH — drift-bot gh pr merge --auto. Safe only if branch protection requires a human reviewer on bot PRs. Branch-protection settings live outside the repo.
• MEDIUM — update-competitive-matrix.yml runs its script before creating the throwaway branch, so the push-capable token is in env during script execution.

Verification

• ✅ zizmor --config .github/zizmor.yml --min-severity medium .github/workflows/ — clean (5 allowlisted, 55 below threshold)
• ✅ pnpm install --frozen-lockfile with pnpm 11.1.2
• ✅ pnpm run lint
• ✅ pnpm run build
• ✅ pnpm run test — 2856/2857 pass locally on Windows; the one failure is a pre-existing Windows path-separator quirk in fixtures-remote.test.ts (Linux CI unaffected)

Test plan

• CI green on this PR (all existing workflows + new zizmor)
• Post-merge: trigger publish-docker.yml via workflow_dispatch on main to confirm SHA-pinned docker actions still build and push
• Next release: confirm publish-release.yml still publishes to npm + creates GitHub Release + tag (highest blast radius)

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@copilotkit/aimock@200

commit: 806be4f

[MikeRyanDev]

No serious supply-chain or CI hardening blockers found. The release workflow builds in a no-secret build job, publishes from downloaded artifacts with NODE_AUTH_TOKEN only on npm publish, PR Docker cache scope is isolated from release scope, pull_request_target notify paths do not checkout PR code, actions are pinned, and checks are green.