From c9b513ca1dabd2ef876b63106daf9e33af7cb82b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marko=20Babi=C4=87?= <marko@narrative.io>
Date: Mon, 17 Aug 2026 16:33:47 -0700
Subject: [PATCH] ci: [SC-66825] run zizmor and fix GitHub Actions findings

Adds a zizmor CI workflow modeled on narrative-skills-marketplace
(PR #108) and fixes the findings it reports.

backup-daily.yml:
- secrets-inherit: drops 'secrets: inherit'. The called workflow only
  uses GITHUB_TOKEN, which is passed to called workflows automatically;
  AWS access comes from the self-hosted runner's instance profile.
- excessive-permissions: scopes the workflow to contents: read.

library/src/plugins/vue-fontawesome/.github/workflows/ci.yml (removed):
All four findings in the vendored tree, including both high-severity
ones (unpinned-uses on actions/checkout@v1 and actions/setup-node@v1),
came from this single file: a vendored copy of FortAwesome's upstream
CI config, untouched since 2020. GitHub only executes workflows under
the repository root's .github/workflows/, so it never ran.

The vendored library source beside it is untouched and still imported
by library/src/index.js, as are the upstream issue templates, which
carried no findings.

No suppressions added.
---
 .github/workflows/backup-daily.yml            |  6 +++-
 .github/workflows/zizmor.yml                  | 26 +++++++++++++++++
 .../vue-fontawesome/.github/workflows/ci.yml  | 29 -------------------
 3 files changed, 31 insertions(+), 30 deletions(-)
 create mode 100644 .github/workflows/zizmor.yml
 delete mode 100644 library/src/plugins/vue-fontawesome/.github/workflows/ci.yml

diff --git a/.github/workflows/backup-daily.yml b/.github/workflows/backup-daily.yml
index f1824b30..be953bc0 100644
--- a/.github/workflows/backup-daily.yml
+++ b/.github/workflows/backup-daily.yml
@@ -5,8 +5,12 @@ on:
     schedule:
       - cron: 0 6 * * *
 
+# backup.yml only uses GITHUB_TOKEN (passed to called workflows
+# automatically); AWS access comes from the runner's instance profile.
+permissions:
+  contents: read
+
 jobs:
   s3-backup-daily:
     uses: narrative-io/common-github/.github/workflows/backup.yml@ad6b23573ee7a7573f6499818f61429cc5238e76 # 2026-07-16, post-hardening (sc-62809)
     # uses: ./.github/workflows/backup.yml
-    secrets: inherit
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000..4f355c6c
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read         # Only needed for private repos. Needed to clone the repo.
+      actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
diff --git a/library/src/plugins/vue-fontawesome/.github/workflows/ci.yml b/library/src/plugins/vue-fontawesome/.github/workflows/ci.yml
deleted file mode 100644
index c8e1a41e..00000000
--- a/library/src/plugins/vue-fontawesome/.github/workflows/ci.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-name: CI
-
-on: [push]
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        node-version: [8.x, 10.x, 12.x]
-
-    steps:
-    - uses: actions/checkout@v1
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
-      with:
-        node-version: ${{ matrix.node-version }}
-    - name: install, build, and test
-      run: |
-        npm install
-        npm run build
-        npm run test
-      env:
-        CI: true
-    - name: dist
-      run: |
-        npm run dist