ci: self-explanatory workflows and a separate workflow audit

.github/workflows/ci.yml

@@ -15,6 +15,7 @@ concurrency:
 
 jobs:
   test:
+    name: Test
     runs-on: ubuntu-latest
     steps:
       - name: ⬇️ Checkout repo
@@ -28,10 +29,9 @@ jobs:
           node-version-file: .node-version
 
       - name: ⌛ Setup pnpm
-        # First-party action, deliberately tracked at @main.
-        uses: withvariablelab/gh-actions/actions/setup-pnpm@main # zizmor: ignore[unpinned-uses]
+        uses: withvariablelab/gh-actions/actions/setup-pnpm@main
 
-      - name: 💅 Check
+      - name: 💅 Lint and typecheck
         run: pnpm rr check
 
       - name: 🎭 Install Playwright browsers
@@ -42,20 +42,3 @@ jobs:
 
       - name: 🔨 Build
         run: pnpm rr pack
-
-  zizmor:
-    runs-on: ubuntu-latest
-    steps:
-      - name: ⬇️ Checkout repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-        with:
-          persist-credentials: false
-
-      # Audits .github/ (the repo has no other workflows or actions). Passing the
-      # repo root keeps the annotation paths repo-relative so they land on the diff.
-      - name: 🌈 Audit workflows (zizmor)
-        env:
-          # Read-only token so zizmor also runs its online audits
-          # (known-vulnerable-actions, impostor-commit, ref-confusion).
-          GH_TOKEN: ${{ github.token }}
-        run: pipx run --spec zizmor==1.30.1 zizmor --format=github .

.github/workflows/release.yml

@@ -9,7 +9,6 @@ on:
     branches:
       - main
 
-# The org default GITHUB_TOKEN is read-only; each job asks for exactly what it needs.
 permissions: {}
 
 concurrency:
@@ -18,19 +17,16 @@ concurrency:
 
 jobs:
   release:
+    name: Release
     if: ${{ github.event_name == 'push' }}
     runs-on: ubuntu-latest
-    # Pushes, the version PR and the GitHub releases go through the vland-bot
-    # token minted below, not GITHUB_TOKEN.
     permissions:
       id-token: write # npm trusted publishing (OIDC)
       contents: read # checkout
     steps:
       - name: ⬇️ Checkout repo
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
-          # changesets/action writes ~/.netrc with its GITHUB_TOKEN (the
-          # vland-bot token below) and pushes through it.
           persist-credentials: false
 
       - name: 🟢 Setup Node.js
@@ -39,8 +35,7 @@ jobs:
           node-version-file: .node-version
 
       - name: ⌛ Setup pnpm
-        # First-party action, deliberately tracked at @main.
-        uses: withvariablelab/gh-actions/actions/setup-pnpm@main # zizmor: ignore[unpinned-uses]
+        uses: withvariablelab/gh-actions/actions/setup-pnpm@main
 
       - name: 🔑 Mint vland-bot token
         id: app-token
@@ -60,21 +55,22 @@ jobs:
           git config user.name "${APP_SLUG}[bot]"
           git config user.email "${user_id}+${APP_SLUG}[bot]@users.noreply.github.com"
 
-      - name: 🚀 Create release PR or publish versions
+      - name: 🚀 Release or version PR
         uses: changesets/action@a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d # v1.9.0
         with:
           commit: "chore: update versions"
           title: "chore: update versions"
           publish: pnpm changeset publish
           setupGitUser: false
+          github-token: ${{ steps.app-token.outputs.token }}
+          commitMode: github-api
         env:
-          # The bot opens the version PR, so CI runs on it.
           GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           LEFTHOOK: 0
 
-  # Runs the PR's code and publishes the preview to npm via OIDC. It never sees
-  # the vland-bot key; it only hands the published package list to the next job.
+  # Runs PR code: never give this job the bot key.
   preview:
+    name: Publish preview
     if: ${{ github.event_name == 'pull_request' && (startsWith(github.head_ref, 'feat') || startsWith(github.head_ref, 'fix') || contains(github.event.pull_request.labels.*.name, 'preview')) }}
     runs-on: ubuntu-latest
     permissions:
@@ -93,28 +89,22 @@ jobs:
         with:
           node-version-file: .node-version
 
-      - name: ⌛ Setup CI
-        # First-party action, deliberately tracked at @main.
-        uses: withvariablelab/gh-actions/actions/setup-pnpm@main # zizmor: ignore[unpinned-uses]
+      - name: ⌛ Setup pnpm
+        uses: withvariablelab/gh-actions/actions/setup-pnpm@main
 
       - name: 🚀 Publish preview
         id: preview
-        # First-party action, deliberately tracked at @main.
-        uses: withvariablelab/gh-actions/actions/preview-release@main # zizmor: ignore[unpinned-uses]
+        uses: withvariablelab/gh-actions/actions/preview-release@main
         with:
           mode: publish
-          # Keep this explicit while the repo has a project .npmrc: preview-release
-          # auto-detects any .npmrc as token-only, and there is no NPM_TOKEN here.
+          # Explicit: an .npmrc would make preview-release default to token mode.
           publish_mode: oidc-only
-
-  # Never checks out or runs PR code: the reusable workflow mints the vland-bot
-  # token (pull-requests: write, this repo only) and upserts the PR comment.
   preview-comment:
+    name: Comment preview
     needs: preview
     if: ${{ needs.preview.result == 'success' }}
     permissions: {}
-    # First-party reusable workflow, deliberately tracked at @main.
-    uses: withvariablelab/gh-actions/.github/workflows/preview-comment.yml@main # zizmor: ignore[unpinned-uses]
+    uses: withvariablelab/gh-actions/.github/workflows/preview-comment.yml@main
     with:
       action: preview-release
       packages: ${{ needs.preview.outputs.packages }}

.github/workflows/workflow-audit.yml

@@ -0,0 +1,31 @@
+name: Workflow audit
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+    branches:
+      - main
+
+permissions:
+  contents: read # checkout
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  audit-workflows:
+    name: Audit workflows
+    runs-on: ubuntu-latest
+    steps:
+      - name: ⬇️ Checkout repo
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      # Repo root, not .github/: keeps annotation paths repo-relative.
+      - name: 🔒 Scan workflows
+        env:
+          # Enables zizmor's online audits.
+          GH_TOKEN: ${{ github.token }}
+        run: pipx run --spec zizmor==1.30.1 zizmor --format=github .

.github/zizmor.yml

@@ -0,0 +1,7 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # First-party withvariablelab/gh-actions is tracked at @main on purpose.
+        "withvariablelab/*": ref-pin
+        "*": hash-pin