Audit the workflows themselves; nothing was checking CI's own config

[jfmercer]

Adds zizmor (security) and actionlint (correctness) over the two workflow files, plus ruff over the Python. Declines CodeQL — its supported languages don't include shell, which is ~95% of this repo's executable surface, and on workflows zizmor has far more audits.

Why

Two things, both measured rather than assumed:

• ci.yaml had no permissions: block, and this repo's default_workflow_permissions is write. So bootstrap (pipes a curl'd script into bash) and apply (executes the whole tree) each ran with a read/write GITHUB_TOKEN.
• The actions were tag-pinned, and tags can be force-moved. CLAUDE.md already makes that argument for .chezmoiexternal.yaml; the actions holding the token were the exception.

zizmor on the original tree: 19 findings — 7 High unpinned-uses, 6 Medium excessive-permissions, 6 Low artipacked. After this change: none.

Hash-pinning is the point, not the paperwork

Four zizmor audits inspect the commit, and none can run on a tag pin:

Audit	Verifies
impostor-commit	The commit came from that repo, not a fork in its network. GitHub serves any commit in a fork network from any repo URL in it, so actions/checkout@<attacker-fork-sha> resolves and looks legitimate.
ref-version-mismatch	The # vX.Y.Z comment corresponds to that commit — which kills the usual objection that SHA pins turn the comment into an unverified lie.
stale-action-refs	The commit sits on a release tag.
known-vulnerable-actions	No CVE against the pinned version.

The canary

Those audits are online and fail silently-open: with no GH_TOKEN, zizmor reports nothing and exits 0. A job that lost its token would stay green while checking none of this. tests/fixtures/zizmor/canary.yml pins a real commit under a deliberately wrong version comment; the job fails unless ref-version-mismatch fires. Same reasoning as the test job's Assert nothing was skipped step.

bump-deps gains an ACTION pin class

Rewrites the commit and its version comment together — a comment left to rot is worse than a tag pin, since it's what a human reads. Its files is a list, closing a pre-existing gap: only ci.yaml was registered, so --apply would rewrite five pins there, leave deps.yaml behind, and then report "all pins current".

Found by the linters, not by me

• run: "$HOME/.../install.sh" — YAML consumes the quotes, so bash received the path bare and split it on any space in $HOME.
• Two dead imports in bin/bump-deps that py_compile cannot see.
• Two intentional-Markdown SC2016 hits in deps.yaml, scoped to the compound command.

And one I introduced: the new invariant first used re.search over the whole file, so it passed as long as one well-formed pin existed anywhere in it — reverting one of six checkouts slipped through. Caught while proving the gate could fail, and pinned down by test_one_bad_pin_among_several_good_ones_is_caught.

Verification

zizmor/actionlint/ruff clean; bump-deps --self-test and --check pass; ./tests/run green at 56 tests with nothing skipped. All five breakages now documented in tests/README.md were verified to turn the suite red, including both canary failure modes (corrected fixture, and absent token).

Two things left for you

• Repo settings: secret scanning and push protection are both disabled (free on a public repo) — complements gitleaks by blocking at push time rather than only auditing history. Optionally flip default_workflow_permissions to read as defense-in-depth behind the new explicit blocks.
• GITLEAKS_ENABLE_COMMENTS: false is set so the secrets job stays at contents: read. If you'd rather keep PR comments, that job needs pull-requests: write instead.

Pre-existing and untouched: zsh-completions is 2 commits behind in .chezmoiexternal.yaml, so bump-deps --check still exits 1. That's an EXTERNAL pulling unread upstream code and wants a deliberate confirmation, so I left it alone.