ci: supply-chain baseline (P3): least-privilege jobs, zizmor, Dependabot cooldowns

.github/dependabot.yml

@@ -0,0 +1,20 @@
+# Dependabot version updates (homelab-governance supply-chain baseline, 2026-10-20). Every update waits out a cooldown
+# of 7 days and merging stays the owner's.
+# - github-actions: keeps the SHA pins and their "# vX.Y.Z" comments up to date.
+# - docker: the two LOCAL MOD `FROM` lines in Dockerfile (CLAUDE.md, "Version Bump Procedure"). Dockerfile.unmodified is
+#   ServiceNow-signed vendor content and is never edited, so it is excluded. Major bumps are ignored: the runtime stays on
+#   EL9 by decision (AlmaLinux 10 needs x86-64-v3), and a builder JDK bump must be checked against the signature gate first.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule: { interval: weekly }
+    cooldown: { default-days: 7 }
+  - package-ecosystem: docker
+    directory: /
+    exclude-paths: [Dockerfile.unmodified]
+    schedule: { interval: weekly }
+    cooldown: { default-days: 7 } # major bumps are ignored below, so no semver-major-days
+    ignore:
+      - dependency-name: "*"
+        update-types: [version-update:semver-major]

.github/workflows/ci.yml

@@ -5,12 +5,16 @@ on:
     branches: [main]
   pull_request:
 
-permissions:
-  contents: read
+# Supply-chain baseline (homelab-governance, 2026-10-20): every action pinned to a full commit SHA with its tag as a
+# comment, checkouts keep no token. The workflow grants nothing; each job asks for exactly what it needs.
+permissions: {}
+concurrency: { group: "ci-${{ github.ref }}", cancel-in-progress: true } # a newer push supersedes a running check
 
 jobs:
   scripts:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -19,3 +23,18 @@ jobs:
         run: shellcheck scripts/get_mid_url.sh tests/get_mid_url_test.sh
       - name: get_mid_url.sh tests
         run: tests/get_mid_url_test.sh
+
+  zizmor:
+    # security audit of the workflows and dependabot.yml (config: .github/zizmor.yml). The action runs zizmor's container
+    # image by version and digest (its support/versions list); results go to the log, not to code scanning.
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          version: "1.30.1"
+          advanced-security: false

.github/zizmor.yml

@@ -0,0 +1,10 @@
+# zizmor configuration (homelab-governance supply-chain baseline, 2026-10-18; keys checked against the zizmor 1.30.1 docs, docs/audits.md).
+# Any ignore goes inline at the finding (`# zizmor: ignore[<audit>]`) with its reason, not here.
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": hash-pin # every action, ours included, by full commit SHA
+  dependabot-cooldown:
+    config:
+      days: 7 # the minimum default-days per ecosystem