ci: Configure more steps more explicitly (#61401)

Also adds some Zizmor validations.

Release Notes:

- N/A

.github/actions/run_tests/action.yml

@@ -5,7 +5,9 @@ runs:
   using: "composite"
   steps:
     - name: Install nextest
-      uses: taiki-e/install-action@921e2c9f7148d7ba14cd819f417db338f63e733c # nextest
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9 # 2.84.0
+      with:
+        tool: nextest
 
     - name: Install Node
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/actions/run_tests_windows/action.yml

@@ -12,7 +12,9 @@ runs:
   steps:
     - name: Install test runner
       working-directory: ${{ inputs.working-directory }}
-      uses: taiki-e/install-action@921e2c9f7148d7ba14cd819f417db338f63e733c # nextest
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9 # 2.84.0
+      with:
+        tool: nextest
 
     - name: Install Node
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4

.github/workflows/add_commented_closed_issue_to_project.yml

@@ -40,6 +40,9 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-members: read
+          permission-organization-projects: write
 
       - if: steps.is-post-close-comment.outputs.result == 'true'
         id: check-staff

.github/workflows/autofix_pr.yml

@@ -53,7 +53,7 @@ jobs:
         version: '9'
     - name: autofix_pr::run_autofix::install_cargo_machete
       if: ${{ inputs.run_clippy }}
-      uses: taiki-e/install-action@02cc5f8ca9f2301050c0c099055816a41ee05507
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9
       with:
         tool: cargo-machete@0.7.0
     - name: autofix_pr::run_autofix::run_cargo_fix
@@ -104,6 +104,8 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
         permission-contents: write
         permission-workflows: write
     - name: steps::checkout_repo

.github/workflows/bump_patch_version.yml

@@ -23,6 +23,9 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
+        permission-contents: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       with:
@@ -55,7 +58,7 @@ jobs:
             echo "tag_suffix=$tag_suffix"
         } >> "$GITHUB_OUTPUT"
     - name: steps::install_cargo_edit
-      uses: taiki-e/install-action@02cc5f8ca9f2301050c0c099055816a41ee05507
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9
       with:
         tool: cargo-edit
     - id: bump-version

.github/workflows/bump_zed_version.yml

@@ -21,6 +21,9 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
+        permission-contents: read
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       with:
@@ -98,6 +101,10 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
+        permission-contents: write
+        permission-pull-requests: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       with:
@@ -105,7 +112,7 @@ jobs:
         ref: main
         token: ${{ steps.generate-token.outputs.token }}
     - name: steps::install_cargo_edit
-      uses: taiki-e/install-action@02cc5f8ca9f2301050c0c099055816a41ee05507
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9
       with:
         tool: cargo-edit
     - name: bump_zed_version::bump_main::bump_version
@@ -141,6 +148,9 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
+        permission-contents: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       with:
@@ -196,6 +206,9 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
+        permission-contents: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       with:

.github/workflows/catch_blank_issues.yml

@@ -21,6 +21,9 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-members: read
+          permission-issues: write
 
       - id: check-staff
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1

.github/workflows/cherry_pick.yml

@@ -33,6 +33,8 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
         permission-contents: write
         permission-workflows: write
         permission-pull-requests: write

.github/workflows/comment_on_potential_duplicate_issues.yml

@@ -41,6 +41,8 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-issues: write
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0

.github/workflows/community_pr_board.yml

@@ -12,6 +12,9 @@
 name: Community PR Board
 
 on:
+  # zizmor: ignore[dangerous-triggers]
+  # Fork PRs must be supported, but this workflow only reads event metadata and
+  # checks out scripts from the trusted default branch; it never executes PR code.
   pull_request_target:
     types: [labeled, unlabeled, assigned, review_requested, edited]
   issue_comment:
@@ -50,6 +53,10 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-issues: read
+          permission-organization-projects: write
+          permission-pull-requests: read
 
       - name: Checkout repository
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

.github/workflows/community_pr_board_refresh.yml

@@ -32,6 +32,10 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-issues: read
+          permission-organization-projects: write
+          permission-pull-requests: read
 
       - name: Checkout repository
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

.github/workflows/danger.yml

@@ -31,6 +31,7 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
         cache: pnpm
         cache-dependency-path: script/danger/pnpm-lock.yaml
     - name: danger::danger_job::install_deps

.github/workflows/deploy_collab.yml

@@ -68,7 +68,9 @@ jobs:
     - name: steps::download_wasi_sdk
       run: ./script/download-wasi-sdk
     - name: steps::cargo_install_nextest
-      uses: taiki-e/install-action@921e2c9f7148d7ba14cd819f417db338f63e733c
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9
+      with:
+        tool: nextest
     - name: steps::clear_target_dir_if_large
       run: ./script/clear-target-dir-if-larger-than 350 200
     - name: deploy_collab::tests::run_collab_tests

.github/workflows/docs_suggestions.yml

@@ -9,32 +9,25 @@ name: Documentation Suggestions
 # 5. Keep this workflow focused on suggestions only until that stable workflow is added.
 
 on:
-  # Run when PRs are merged to main
+  # Analyze merged PRs on main and cherry-picks to release branches. Each job
+  # further restricts the event actions and target branch that it handles.
   pull_request:
-    types: [closed]
-    branches: [main]
-    paths:
-      - 'crates/**/*.rs'
-      - '!crates/**/*_test.rs'
-      - '!crates/**/tests/**'
-
-  # Run on cherry-picks to release branches
-  pull_request_target:
-    types: [opened, synchronize]
+    types: [closed, opened, synchronize]
     branches:
-      - 'v0.*'
+      - main
+      - "v0.*"
     paths:
-      - 'crates/**/*.rs'
+      - "crates/**/*.rs"
 
   # Manual trigger for testing
   workflow_dispatch:
     inputs:
       pr_number:
-        description: 'PR number to analyze'
+        description: "PR number to analyze"
         required: true
         type: string
       mode:
-        description: 'Output mode'
+        description: "Output mode"
         required: true
         type: choice
         options:
@@ -89,7 +82,6 @@ jobs:
             fi
             sleep $((i * 5))
           done
-          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
         env:
           FACTORY_API_KEY: ${{ secrets.FACTORY_API_KEY }}
 
@@ -125,6 +117,8 @@ jobs:
           FACTORY_API_KEY: ${{ secrets.FACTORY_API_KEY }}
           PR_NUMBER: ${{ steps.pr.outputs.number }}
         run: |
+          export PATH="${HOME}/.local/bin:${PATH}"
+
           # Ensure gh CLI is authenticated (GH_TOKEN may not be auto-detected)
           # Unset GH_TOKEN first to allow gh auth login to store credentials
           echo "$GH_TOKEN" | (unset GH_TOKEN && gh auth login --with-token)
@@ -292,8 +286,10 @@ jobs:
       group: docs-suggestions-${{ github.event.pull_request.number || inputs.pr_number || 'manual' }}
       cancel-in-progress: true
     if: |
-      (github.event_name == 'pull_request_target' &&
+      (github.event_name == 'pull_request' &&
+       contains(fromJSON('["opened","synchronize"]'), github.event.action) &&
        startsWith(github.event.pull_request.base.ref, 'v0.') &&
+       github.event.pull_request.head.repo.full_name == github.repository &&
        contains(fromJSON('["MEMBER","OWNER"]'),
                 github.event.pull_request.author_association)) ||
       (github.event_name == 'workflow_dispatch' && inputs.mode == 'immediate')
@@ -303,7 +299,7 @@ jobs:
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           fetch-depth: 0
-          ref: ${{ github.event_name == 'pull_request_target' && github.event.pull_request.base.ref || '' }}
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.base.ref || '' }}
           persist-credentials: false
 
       - name: Install Droid CLI
@@ -322,7 +318,6 @@ jobs:
             fi
             sleep $((i * 5))
           done
-          echo "${HOME}/.local/bin" >> "$GITHUB_PATH"
         env:
           FACTORY_API_KEY: ${{ secrets.FACTORY_API_KEY }}
 
@@ -350,6 +345,8 @@ jobs:
           FACTORY_API_KEY: ${{ secrets.FACTORY_API_KEY }}
           PR_NUMBER: ${{ steps.pr.outputs.number }}
         run: |
+          export PATH="${HOME}/.local/bin:${PATH}"
+
           # Ensure gh CLI is authenticated (GH_TOKEN may not be auto-detected)
           # Unset GH_TOKEN first to allow gh auth login to store credentials
           echo "$GH_TOKEN" | (unset GH_TOKEN && gh auth login --with-token)

.github/workflows/extension_bump.yml

@@ -81,6 +81,10 @@ jobs:
       with:
         app-id: ${{ secrets.app-id }}
         private-key: ${{ secrets.app-secret }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
+        permission-contents: write
+        permission-pull-requests: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       with:
@@ -170,6 +174,9 @@ jobs:
       with:
         app-id: ${{ secrets.app-id }}
         private-key: ${{ secrets.app-secret }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
+        permission-contents: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       with:
@@ -222,6 +229,10 @@ jobs:
         private-key: ${{ secrets.app-secret }}
         owner: zed-industries
         repositories: extensions
+        permission-contents: write
+        permission-issues: write
+        permission-members: read
+        permission-pull-requests: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       with:

.github/workflows/extension_tests.yml

@@ -99,7 +99,9 @@ jobs:
       env:
         PACKAGE_NAME: ${{ steps.get-package-name.outputs.package_name }}
     - name: steps::cargo_install_nextest
-      uses: taiki-e/install-action@921e2c9f7148d7ba14cd819f417db338f63e733c
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9
+      with:
+        tool: nextest
     - name: extension_tests::run_nextest
       run: 'cargo nextest run -p "$PACKAGE_NAME" --no-fail-fast --no-tests=warn --target "$(rustc -vV | sed -n ''s|host: ||p'')"'
       env:

.github/workflows/extension_workflow_rollout.yml

@@ -72,7 +72,7 @@ jobs:
               .filter(repo => !repo.archived)
               .map(repo => repo.name);
 
-          const filterInput = `${{ inputs.filter-repos }}`.trim();
+          const filterInput = process.env.FILTER_REPOS.trim();
           if (filterInput.length > 0) {
               const allowedNames = filterInput.split(',').map(s => s.trim()).filter(s => s.length > 0);
               filteredRepos = filteredRepos.filter(name => allowedNames.includes(name));
@@ -82,6 +82,8 @@ jobs:
           console.log(`Found ${filteredRepos.length} extension repos`);
           return filteredRepos;
         result-encoding: json
+      env:
+        FILTER_REPOS: ${{ inputs.filter-repos }}
     - name: steps::cache_rust_dependencies_namespace
       uses: namespacelabs/nscloud-cache-action@a90bb5d4b27522ce881c6e98eebd7d7e6d1653f9
       with:
@@ -215,6 +217,8 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
         permission-contents: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd

.github/workflows/guild_assignment_status.yml

@@ -34,6 +34,11 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-issues: write
+          permission-members: read
+          permission-organization-projects: write
+          permission-pull-requests: read
 
       - name: Checkout repository
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

.github/workflows/guild_new_pr_notify.yml

@@ -7,6 +7,9 @@
 name: Guild New PR Notification
 
 on:
+  # zizmor: ignore[dangerous-triggers]
+  # Fork PRs must be supported, but this workflow only reads event metadata and
+  # checks out scripts from the trusted default branch; it never executes PR code.
   pull_request_target:
     types: [opened]
 
@@ -31,6 +34,11 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-issues: write
+          permission-members: read
+          permission-organization-projects: write
+          permission-pull-requests: read
 
       - name: Checkout repository
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

.github/workflows/guild_stale_assignments.yml

@@ -32,6 +32,11 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-issues: write
+          permission-members: read
+          permission-organization-projects: write
+          permission-pull-requests: read
 
       - name: Checkout repository
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

.github/workflows/guild_weekly_shipped.yml

@@ -30,6 +30,11 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-issues: read
+          permission-members: read
+          permission-organization-projects: read
+          permission-pull-requests: read
 
       - name: Checkout repository
         uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1

.github/workflows/pr_issue_labeler.yml

@@ -12,6 +12,9 @@ name: PR Issue Labeler
 on:
   issues:
     types: [opened]
+  # zizmor: ignore[dangerous-triggers]
+  # Fork PRs must be labeled, but this workflow only passes GitHub-provided event
+  # metadata to a pinned action; it never checks out or executes PR code.
   pull_request_target:
     types: [opened]
 
@@ -30,6 +33,10 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-issues: write
+          permission-members: read
+          permission-pull-requests: read
 
       - id: apply-authorship-label
         uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1

.github/workflows/publish_extension_cli.yml

@@ -42,6 +42,8 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
         permission-contents: write
     - name: steps::update_tag
       uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
@@ -67,6 +69,11 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
+        permission-contents: write
+        permission-pull-requests: write
+        permission-workflows: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       with:
@@ -121,6 +128,9 @@ jobs:
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
         owner: zed-industries
         repositories: extensions
+        permission-contents: write
+        permission-pull-requests: write
+        permission-workflows: write
     - id: short-sha
       name: publish_extension_cli::get_short_sha
       run: |

.github/workflows/release.yml

@@ -33,8 +33,11 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::cargo_install_nextest
-      uses: taiki-e/install-action@921e2c9f7148d7ba14cd819f417db338f63e733c
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9
+      with:
+        tool: nextest
     - name: steps::clear_target_dir_if_large
       run: ./script/clear-target-dir-if-larger-than 350 200
     - name: steps::setup_sccache
@@ -82,8 +85,11 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::cargo_install_nextest
-      uses: taiki-e/install-action@921e2c9f7148d7ba14cd819f417db338f63e733c
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9
+      with:
+        tool: nextest
     - name: steps::clear_target_dir_if_large
       run: ./script/clear-target-dir-if-larger-than 350 200
     - name: steps::setup_sccache
@@ -128,6 +134,7 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::clear_target_dir_if_large
       run: ./script/clear-target-dir-if-larger-than.ps1 350 200
       shell: pwsh
@@ -254,13 +261,6 @@ jobs:
         clean: false
     - name: run_tests::check_scripts::run_shellcheck
       run: ./script/shellcheck-scripts error
-    - id: get_actionlint
-      name: run_tests::check_scripts::download_actionlint
-      run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
-    - name: run_tests::check_scripts::run_actionlint
-      run: '"$ACTIONLINT_BIN" -color'
-      env:
-        ACTIONLINT_BIN: ${{ steps.get_actionlint.outputs.executable }}
     - name: steps::cache_rust_dependencies_namespace
       uses: namespacelabs/nscloud-cache-action@a90bb5d4b27522ce881c6e98eebd7d7e6d1653f9
       with:
@@ -274,6 +274,19 @@ jobs:
           echo "Please run 'cargo xtask workflows' locally and commit the changes"
           exit 1
         fi
+    - id: get_actionlint
+      name: run_tests::check_scripts::download_actionlint
+      run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+    - name: run_tests::check_scripts::run_actionlint
+      run: '"$ACTIONLINT_BIN" -color'
+      env:
+        ACTIONLINT_BIN: ${{ steps.get_actionlint.outputs.executable }}
+    - name: run_tests::check_scripts::run_zizmor
+      uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02
+      with:
+        advanced-security: false
+        min-severity: high
+        version: latest
     timeout-minutes: 60
   create_draft_release:
     if: (github.repository_owner == 'zed-industries' || github.repository_owner == 'zed-extensions')
@@ -285,6 +298,8 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
         permission-contents: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
@@ -545,6 +560,7 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::setup_sentry
       uses: matbour/setup-sentry-cli@3e938c54b3018bdd019973689ef984e033b0454b
       with:
@@ -596,6 +612,7 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::setup_sentry
       uses: matbour/setup-sentry-cli@3e938c54b3018bdd019973689ef984e033b0454b
       with:
@@ -845,6 +862,9 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
+        permission-contents: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
       with:

.github/workflows/release_nightly.yml

@@ -64,8 +64,11 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::cargo_install_nextest
-      uses: taiki-e/install-action@921e2c9f7148d7ba14cd819f417db338f63e733c
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9
+      with:
+        tool: nextest
     - name: steps::clear_target_dir_if_large
       run: ./script/clear-target-dir-if-larger-than 350 200
     - name: steps::setup_sccache
@@ -290,6 +293,7 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::setup_sentry
       uses: matbour/setup-sentry-cli@3e938c54b3018bdd019973689ef984e033b0454b
       with:
@@ -345,6 +349,7 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::setup_sentry
       uses: matbour/setup-sentry-cli@3e938c54b3018bdd019973689ef984e033b0454b
       with:
@@ -574,6 +579,8 @@ jobs:
       with:
         app-id: ${{ secrets.ZED_ZIPPY_APP_ID }}
         private-key: ${{ secrets.ZED_ZIPPY_APP_PRIVATE_KEY }}
+        owner: ${{ github.repository_owner }}
+        repositories: ${{ github.event.repository.name }}
         permission-contents: write
     - name: steps::checkout_repo
       uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd

.github/workflows/run_bundling.yml

@@ -197,6 +197,7 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::setup_sentry
       uses: matbour/setup-sentry-cli@3e938c54b3018bdd019973689ef984e033b0454b
       with:
@@ -247,6 +248,7 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::setup_sentry
       uses: matbour/setup-sentry-cli@3e938c54b3018bdd019973689ef984e033b0454b
       with:

.github/workflows/run_tests.yml

@@ -344,6 +344,7 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::clear_target_dir_if_large
       run: ./script/clear-target-dir-if-larger-than.ps1 350 200
       shell: pwsh
@@ -402,8 +403,11 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::cargo_install_nextest
-      uses: taiki-e/install-action@921e2c9f7148d7ba14cd819f417db338f63e733c
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9
+      with:
+        tool: nextest
     - name: steps::clear_target_dir_if_large
       run: ./script/clear-target-dir-if-larger-than 350 200
     - name: steps::setup_sccache
@@ -454,8 +458,11 @@ jobs:
       with:
         node-version: '24'
         check-latest: true
+        package-manager-cache: false
     - name: steps::cargo_install_nextest
-      uses: taiki-e/install-action@921e2c9f7148d7ba14cd819f417db338f63e733c
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9
+      with:
+        tool: nextest
     - name: steps::clear_target_dir_if_large
       run: ./script/clear-target-dir-if-larger-than 350 200
     - name: steps::setup_sccache
@@ -694,7 +701,7 @@ jobs:
         cache: rust
         path: ~/.rustup
     - name: run_tests::check_dependencies::install_cargo_machete
-      uses: taiki-e/install-action@02cc5f8ca9f2301050c0c099055816a41ee05507
+      uses: taiki-e/install-action@a6b2e2dcd845ddd7f509ce4f3ed3d922b80cc5d9
       with:
         tool: cargo-machete@0.7.0
     - name: run_tests::check_dependencies::run_cargo_machete
@@ -804,13 +811,6 @@ jobs:
         clean: false
     - name: run_tests::check_scripts::run_shellcheck
       run: ./script/shellcheck-scripts error
-    - id: get_actionlint
-      name: run_tests::check_scripts::download_actionlint
-      run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
-    - name: run_tests::check_scripts::run_actionlint
-      run: '"$ACTIONLINT_BIN" -color'
-      env:
-        ACTIONLINT_BIN: ${{ steps.get_actionlint.outputs.executable }}
     - name: steps::cache_rust_dependencies_namespace
       uses: namespacelabs/nscloud-cache-action@a90bb5d4b27522ce881c6e98eebd7d7e6d1653f9
       with:
@@ -824,6 +824,19 @@ jobs:
           echo "Please run 'cargo xtask workflows' locally and commit the changes"
           exit 1
         fi
+    - id: get_actionlint
+      name: run_tests::check_scripts::download_actionlint
+      run: bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+    - name: run_tests::check_scripts::run_actionlint
+      run: '"$ACTIONLINT_BIN" -color'
+      env:
+        ACTIONLINT_BIN: ${{ steps.get_actionlint.outputs.executable }}
+    - name: run_tests::check_scripts::run_zizmor
+      uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02
+      with:
+        advanced-security: false
+        min-severity: high
+        version: latest
     timeout-minutes: 60
   check_postgres_and_protobuf_migrations:
     needs:

.github/workflows/slack_notify_community_automation_failure.yml

@@ -5,6 +5,9 @@
 name: Notify Slack on community automation failure
 
 on:
+  # zizmor: ignore[dangerous-triggers]
+  # The job validates that the completed run came from this repository, was
+  # started by an expected event, and failed before exposing the Slack secret.
   workflow_run:
     workflows:
       - "Comment on potential duplicate bug/crash reports"
@@ -24,7 +27,9 @@ permissions:
 jobs:
   notify-slack:
     if: >-
-      github.repository_owner == 'zed-industries'
+      github.repository == 'zed-industries/zed'
+      && github.event.workflow_run.head_repository.full_name == github.repository
+      && contains(fromJSON('["issues","issue_comment","pull_request","pull_request_target","schedule","workflow_dispatch"]'), github.event.workflow_run.event)
       && github.event.workflow_run.conclusion == 'failure'
     runs-on: namespace-profile-2x4-ubuntu-2404
 

.github/workflows/track_duplicate_bot_effectiveness.yml

@@ -35,6 +35,9 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-issues: read
+          permission-organization-projects: write
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
@@ -74,6 +77,9 @@ jobs:
           app-id: ${{ secrets.ZED_COMMUNITY_BOT_APP_ID }}
           private-key: ${{ secrets.ZED_COMMUNITY_BOT_PRIVATE_KEY }}
           owner: zed-industries
+          repositories: zed
+          permission-issues: read
+          permission-organization-projects: write
 
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0

.github/workflows/triage_project_sync.yml

@@ -91,6 +91,7 @@ jobs:
           # mutations. Without `owner:`, the default token is repo-scoped and
           # cannot write to org projects.
           owner: zed-industries
+          repositories: zed
           # Scope the token down to the minimum needed for this workflow.
           # Even though the App may have broader permissions for other
           # automations (e.g., Issues:Write for the dupe-bot), this token

.github/zizmor.yml

@@ -0,0 +1 @@
+rules: {}