Hooks management command + build & supply-chain hardening

.github/workflows/ci.yml

@@ -20,7 +20,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
@@ -58,7 +60,9 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
@@ -74,8 +78,45 @@ jobs:
 
       - name: Upload performance report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: zero-performance-smoke
           path: dist/perf/perf-bench.json
           if-no-files-found: warn
+
+  security:
+    name: Security & code health
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Setup Go
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff
+        with:
+          go-version-file: go.mod
+          cache: true
+
+      # govulncheck and deadcode resolve a toolchain from their own modules, which
+      # can drop below the version go.mod requires and then fail to load our
+      # packages. Pin GOTOOLCHAIN to the go.mod toolchain so both run under it.
+      - name: Pin toolchain from go.mod
+        run: |
+          toolchain="$(awk '/^toolchain /{print $2}' go.mod)"
+          echo "GOTOOLCHAIN=${toolchain:-auto}" >> "$GITHUB_ENV"
+
+      # Hard gate: fails the build when code reaches a known vulnerability. A stdlib
+      # CVE is cleared by a toolchain bump (see go.mod). May also flag a newly
+      # published advisory on an unrelated PR — intentional: do not ship known vulns.
+      - name: govulncheck
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.3.0 ./...
+
+      # Advisory: reports functions unreachable from any cmd/* main so dormant
+      # code is visible in CI. Non-blocking while the dormant subsystems are
+      # still being wired or removed.
+      - name: deadcode (advisory)
+        continue-on-error: true
+        run: go run golang.org/x/tools/cmd/deadcode@v0.46.0 -test=false ./...

.github/workflows/pr-auto-review.yml

@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
 
@@ -80,7 +80,7 @@ jobs:
 
       - name: Post review summary
         if: always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:
           ZERO_REVIEW_BODY_PATH: ${{ steps.review-summary.outputs.path }}
         with:

.github/workflows/release-artifacts.yml

@@ -26,11 +26,11 @@ jobs:
     steps:
       - name: Checkout
         if: ${{ github.event_name != 'workflow_dispatch' || inputs.ref == '' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Checkout requested ref
         if: ${{ github.event_name == 'workflow_dispatch' && inputs.ref != '' }}
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           ref: ${{ inputs.ref }}
 
@@ -50,7 +50,7 @@ jobs:
         run: go run ./cmd/zero-release verify
 
       - name: Upload package
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: zero-${{ runner.os }}-${{ runner.arch }}
           path: dist/release/*

.github/workflows/zero-action-smoke.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           persist-credentials: false
 

go.mod

@@ -2,7 +2,7 @@ module github.com/Gitlawb/zero
 
 go 1.24.2
 
-toolchain go1.24.13
+toolchain go1.26.4
 
 require (
 	github.com/charmbracelet/bubbles v1.0.0

internal/cli/extensions.go

@@ -129,6 +129,14 @@ func runHooks(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) i
 			return exitCrash
 		}
 		return exitSuccess
+	case "add":
+		return runHooksAdd(args[1:], stdout, stderr, deps)
+	case "remove", "rm":
+		return runHooksRemove(args[1:], stdout, stderr, deps)
+	case "enable":
+		return runHooksToggle(args[1:], stdout, stderr, deps, false)
+	case "disable":
+		return runHooksToggle(args[1:], stdout, stderr, deps, true)
 	default:
 		return writeExecUsageError(stderr, fmt.Sprintf("unknown hooks subcommand %q", args[0]))
 	}
@@ -563,7 +571,11 @@ func writeHooksHelp(w io.Writer) error {
   zero hooks <command>
 
 Commands:
-  list    List configured Zero hooks
+  list      List configured Zero hooks
+  add       Add or update a hook
+  remove    Remove a hook by id
+  enable    Enable a hook by id
+  disable   Disable a hook by id
 `)
 	return err
 }