[thomson-t]

Why

Workflow security findings are currently reported without failing the check, so an insecure change can still receive a successful result. This change resolves the existing findings and makes the check fail when new findings appear.

Programme

Standalone change, no programme.

What changes

• Pin workflow dependencies to commits and limit credentials and token permissions.
• Add a seven-day cooldown for dependency updates and scan changes to their configuration.
• Remove the disabled dependency automerge workflow, its unused artifact producer, and the unused code-analysis workflow. Retain the shared linter update workflow.
• Make the workflow security scan fail on findings, with no ignored rules.

No documentation, changelog or runbook update is needed because library behavior is unchanged.

Linked work

None.

Rollout

Nothing changes in production; if this is wrong, revert the pull request.

Risks

• New security findings can fail workflow changes; the current scan has no findings; failures appear in pull request checks.
• Ordinary dependency updates arrive later; the configured cooldown is seven days; dependency pull requests show the update cadence.
• Reduced permissions could block automation; required permissions are retained on the jobs that use them; build, release or update runs would report access errors.
• The existing updater token handoff may fail; not addressed because shared updater authentication is outside this cleanup; scheduled update runs would report authentication errors.

Risk class: low.

Who

Written by: pull request author, following the requested workflow security cleanup.
Code reviewed before opening: no maintainer review yet.
Design reviewed before opening: the requester confirmed the scope on 21 October 2026; no public review record.
Decision this implements: the agreed workflow security cleanup, 21 October 2026; no public decision record.
Checked: workflow security scan, static checks and 39 JavaScript tests on 21 October 2026.
Not checked: native builds, left to the existing continuous integration jobs; live release and update runs were not dispatched.

Size

Hand-written: 131 changed lines across 7 files (62 added, 69 removed).
Generated: none.

Notes for reviewers

• Online zizmor 1.31.1 with --no-ignores: zero findings.
• trunk check --no-fix --ci --index: passed, including Actionlint.
• yarn test --runInBand: 8 suites and 39 tests passed, followed by ESLint.
• Simulator output is passed through an environment variable instead of being interpolated into the shell command.
• The existing required build check names are preserved.

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Besides the inline findings, I checked two other things. Dropping release-draft.yml to contents: read doesn't break it, because every write there goes through the App token passed to create-pull-request. Moving the simulator UDID into SIMULATOR_UDID keeps the same -destination value, now safely quoted.

Extended reasoning...

Only GitHub Actions config changed. The change pins actions to SHAs, narrows token permissions, deletes the dependabot-automerge and sonarcloud workflows, and makes zizmor a blocking check. In release-draft.yml, checkout uses persist-credentials: false and the only write step authenticates with the generated App token, so the default GITHUB_TOKEN never needs write scope.

[Copilot]

🔵 Needs a closer look

Inaccessible shared workflow definitions leave compatibility with reduced token permissions unverified.

No open issues 🎉

What changed in this PR

Hardens CI workflows and makes workflow security findings fail checks without changing library behavior.

Changes:

• Pins workflow dependencies and narrows credential and token access.
• Adds seven-day dependency update cooldowns and scans Dependabot configuration changes.
• Removes unused workflows and enables blocking security checks.

File	Description
.github/​workflows/​zizmor.yml	Makes findings blocking and scans Dependabot configuration changes.
.github/​workflows/​trunk-upgrade.yml	Pins the shared updater and scopes permissions.
.github/​workflows/​sonarcloud.yml	Removes unused code-analysis workflow.
.github/​workflows/​release-draft.yml	Pins changelog action and reduces default permissions.
.github/​workflows/​pull-request.yml	Hardens actions, credentials, permissions, and simulator input handling.
.github/​workflows/​dependabot-automerge.yml	Removes disabled automerge workflow.
.github/​dependabot.yml	Adds seven-day update cooldowns.

_{Review effort: Balanced}