Prepare workflows for the zizmor bump in #360

[robzolkos]

#360 bumps zizmor-action v0.5.3 → v0.5.7, which ships a newer zizmor (1.26.x). That version reports five findings the currently pinned zizmor does not, so #360 fails GitHub Actions audit for reasons unrelated to the twenty actions it bumps. zizmor exits non-zero on any finding, so all five must be resolved.

Four of the five are not #360's doing. This clears them on main first, so #360 can go green on a plain rebase without anyone hand-editing a dependabot branch. Of the four, three are fixed, one is removed at the source, and exactly one is suppressed.

adhoc-packages in the publish job — removed, not suppressed

release-typescript.yml ran npm install -g npm@latest: an unpinned install from the registry, inside the publish job that holds id-token: write and the release-npm environment, three steps before npm publish of @37signals/basecamp.

The blast radius is not "a linter is unhappy." A compromised npm@latest there executes against a live OIDC publishing identity and can push a malicious release of this SDK. Pinning the version would narrow that, but zizmor still flags it — the rule is about installing outside a lockfile at all — so a pin buys a suppression, not a fix.

Node 24 bundles npm 11.16, past the 11.5.1 that OIDC trusted publishing requires. The step is simply unnecessary. The publish job now uses Node 24 and takes npm from the Node tarball, which setup-node verifies by checksum. The ad-hoc install is gone rather than accepted.

Verified locally under Node 24 (npm 11.16.0): npm ci, npm run build (what prepublishOnly runs, including postbuild), and the full suite — 616 tests across 64 files, all passing.

adhoc-packages in the bundler-audit job — suppressed, with reason

gem install bundler-audit remains. That job has contents: read, no id-token, no secrets, and does not publish; a compromised install reads a public repository. bundler-audit is also the auditing tool itself, so adding it to the SDK's Gemfile would make the gem under audit depend on its own auditor.

This is the one accepted risk, suppressed inline with a justification, matching the fifteen # zizmor: ignore[...] suppressions already in these workflows.

ref-version-mismatch — 3 medium, latent

The trivy-action pin is commented # 0.35.0. That tag exists, so it is valid today and main is not currently flagged.

Upstream stopped publishing unprefixed tags after it: ed142fd is reachable only as v0.36.0, with no 0.36.0. Dependabot mirrors the existing comment style, so when it bumped trivy in #360 it wrote # 0.36.0 — an unknown ref — and the newer zizmor flagged it three times.

Correcting the comment to # v0.35.0 means the next bump inherits the v prefix and resolves on its own. This improves auditability rather than reducing it: the comment exists so a reviewer can check the hash against a real tag.

Verification

Three of the five findings come from zizmor's online audits, which silently do not run without a GitHub token — a plain local run reports clean and looks like a false alarm. All runs below had GH_TOKEN set.

	low	medium
main today	2	0
#360's head	2	3
this branch	0	0

The 2/3 split on #360's head matches its CI run exactly. The pinned zizmor 1.25.2 that main runs today also still passes here, so the unknown audit name in the ignore comment does not break current CI.

The remaining fifth finding is #360's own trivy comment, which its rebase will regenerate as # v0.36.0 once this lands.

[github-actions]

Sensitive Change Detection (shadow mode)

This PR modifies control-plane files:

• .github/workflows/release-typescript.yml
• .github/workflows/security.yml

Shadow mode — this check is informational only. When activated, changes to these paths will require approval from a maintainer.

[Copilot]

Pull request overview

Prepares the repo’s GitHub Actions workflows to pass a newer zizmor version (as part of zizmor-action bump in #360) by aligning Trivy pin comments with upstream tag naming and suppressing two intentional “ad-hoc” package installs.

Changes:

• Updated aquasecurity/trivy-action pin comments from # 0.35.0 → # v0.35.0 to avoid ref-version-mismatch findings on future Dependabot bumps.
• Added inline zizmor: ignore[adhoc-packages] suppressions (with justification) for gem install bundler-audit and npm install -g npm@latest.

Tip

If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/security.yml	Adjusts Trivy pin comment format and suppresses intentional bundler-audit install to satisfy newer zizmor checks.
.github/workflows/release-typescript.yml	Suppresses intentional global npm upgrade step to satisfy newer zizmor checks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cubic-dev-ai]

No issues found across 2 files

_{Re-trigger cubic}

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.