From 5b562020132cd196277fb17e047836b539b96ddf Mon Sep 17 00:00:00 2001
From: tanmayeepemmaraju <tanmayee.pemmaraju@rokt.com>
Date: Fri, 18 Sep 2026 14:18:15 -0400
Subject: [PATCH 1/2] ci: add zizmor security scan

Adds GitHub Actions security scanning in advisory mode, matching the
configuration merged in mparticle-web-sdk#1444.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/zizmor.yml | 48 ++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..862941b
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,48 @@
+name: Zizmor Security Scan
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+      - development
+    paths:
+      - .github/workflows/**
+      - .github/actions/**
+  push:
+    branches:
+      - main
+      - development
+    paths:
+      - .github/workflows/**
+      - .github/actions/**
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+permissions: {} # deny-by-default; job below grants only what it needs
+
+jobs:
+  zizmor:
+    name: Scan GitHub Actions workflows
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: read # zizmor resolves reusable workflow/action metadata via GitHub API
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 1 # zizmor only needs the tree at HEAD
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        # Permanent advisory mode — zizmor is rolled out across Rokt repos as a
+        # reporter, not a gate. Findings surface as PR annotations so owners
+        # can triage incrementally without blocking unrelated changes.
+        continue-on-error: true
+        with:
+          advanced-security: false
+          annotations: true

From 13666812d4b3150fd221bc65c3e1d14f229fdce2 Mon Sep 17 00:00:00 2001
From: tanmayeepemmaraju <tanmayee.pemmaraju@rokt.com>
Date: Fri, 18 Sep 2026 14:24:46 -0400
Subject: [PATCH 2/2] ci: bump actionlint to 1.7.7

1.6.9 predates the ubuntu-24.04 runner label and rejects an empty
permissions block, both of which the zizmor scan workflow uses. Matches
the pin already used in mparticle-android-sdk, mparticle-apple-sdk and
mparticle-maui-sdk.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .trunk/trunk.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.trunk/trunk.yaml b/.trunk/trunk.yaml
index 68a777f..3ac501b 100644
--- a/.trunk/trunk.yaml
+++ b/.trunk/trunk.yaml
@@ -38,7 +38,7 @@ lint:
             '
           success_codes: [0, 1]
   enabled:
-    - actionlint@1.6.9
+    - actionlint@1.7.7
     - checkov@3.2.507
     - dotenv-linter@3.3.0
     # ESLint 9+ defaults to flat config only; this repo uses .eslintrc.js (ESLint 8 style).