fix(security): resolve CodeQL & zizmor code-scanning alerts (#18)

* fix(security): resolve CodeQL/zizmor code-scanning alerts

- env_utils: replace fragile `find(...) != 0` scheme check with the
  anchored `rfind(prefix, 0) == 0` idiom in validate_url_env (hardens
  the prefix match; CodeQL #1 is a false positive — env-var config
  validation, not an authentication barrier — dismissed separately).
- ci.yml: drop workflow-level `security-events: write`; grant it only to
  the `gates` job that runs CodeQL (zizmor excessive-permissions #7).
- security.yml: pin the org reusable security-scan.yml to a commit SHA
  (zizmor unpinned-uses #5), matching ci.yml's existing convention.
- add .github/zizmor.yml documenting intentional ignores: secrets-inherit
  on first-party org reusable callers (#6, #8) and template-injection in
  gh-aw generated workflow files (#11-20, DO NOT EDIT / maintainer vars).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(env_utils): use strncmp for allocation-free scheme check

Address review feedback: check the http(s):// prefix directly on the
const char* with std::strncmp instead of constructing a std::string,
avoiding an unnecessary heap allocation. strncmp stops at the NUL
terminator, so short values remain safe.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: WomB0ComB0

.github/workflows/ci.yml

@@ -15,17 +15,22 @@ on:
   pull_request:
     branches: [main]
 
+# Least-privilege at the workflow level; the only job that needs to write
+# code-scanning results (the reusable `gates` aggregator, which runs CodeQL)
+# is granted `security-events: write` at the job level below.
 permissions:
   contents: read
-  security-events: write
-  pull-requests: read
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
 jobs:
   gates:
+    permissions:
+      contents: read
+      security-events: write
+      pull-requests: read
     uses: resq-software/.github/.github/workflows/required.yml@f4b51a620aa1bf89c0bce4f434b36f92ff7d517d
     with:
       lang: cpp

.github/workflows/security.yml

@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   scan:
-    uses: resq-software/.github/.github/workflows/security-scan.yml@main
+    uses: resq-software/.github/.github/workflows/security-scan.yml@73b9edb8f4f28a99f70ee22eb5e2dd2bf7807c84 # main
     with:
       languages: '["c-cpp","actions"]'
       enable-semgrep: true

.github/zizmor.yml

@@ -0,0 +1,27 @@
+# zizmor configuration — https://docs.zizmor.sh/configuration/
+#
+# The ignores below are documented, intentional exceptions. Each is either a
+# first-party trusted caller or a file generated by gh-aw (githubnext Agentic
+# Workflows). They are not hand-editable findings.
+rules:
+  # `secrets: inherit` on the thin callers to our own org-wide reusable
+  # workflows in resq-software/.github. The reusables (security-scan / required)
+  # legitimately need the scan tokens (e.g. Semgrep), and the boundary is
+  # first-party, so blanket inheritance is acceptable here.
+  secrets-inherit:
+    ignore:
+      - security.yml
+      - ci.yml
+
+  # template-injection findings live entirely inside gh-aw GENERATED files
+  # ("DO NOT EDIT" — regenerated by `gh aw compile`). The expansions are
+  # maintainer-controlled repository variables / workflow inputs
+  # (e.g. vars.GH_AW_DEFAULT_MAX_AI_CREDITS), not external attacker input.
+  # They cannot be fixed by hand; fixes belong upstream in gh-aw.
+  template-injection:
+    ignore:
+      - agentics-maintenance.yml
+      - ai-auditor.lock.yml
+      - auto-triage-issues.lock.yml
+      - daily-secrets-analysis.lock.yml
+      - duplicate-code-detector.lock.yml

packages/resq-common/include/resq/env_utils.hpp

@@ -140,8 +140,13 @@ inline bool validate_url_env(const char* env_name, bool required = false) {
         return true;
     }
 
-    std::string url(value);
-    if (url.find("http://") != 0 && url.find("https://") != 0) {
+    // Anchored prefix check with strncmp: matches only when the scheme is a
+    // true prefix, and avoids both the fragile `find(...) != 0` idiom and an
+    // allocating std::string copy. value is non-null/non-empty here, and
+    // strncmp stops at the NUL terminator, so short values are safe.
+    const bool has_http_scheme = std::strncmp(value, "http://", 7) == 0 ||
+                                 std::strncmp(value, "https://", 8) == 0;
+    if (!has_http_scheme) {
         std::cerr << "Error: " << env_name << " must start with http:// or https://" << std::endl;
         return false;
     }