Improve actions setup, add static analysis

.github/actions/prepare/action.yml

@@ -5,7 +5,7 @@ runs:
   using: composite
   steps:
     - name: Install Flutter
-      uses: subosito/flutter-action@v2
+      uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
       with:
         flutter-version: "3.x"
         channel: "stable"

.github/dependabot.yml

@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7

.github/workflows/check.yml

@@ -9,7 +9,22 @@ on:
       - "**"
   pull_request:
 
+permissions: {}
+
 jobs:
+  zizmor:
+    permissions:
+      security-events: write # Needed to upload findings as code scanning results.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          persona: pedantic
+
   setup:
     if: github.event_name == 'push' || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository)
     uses: ./.github/workflows/prepare_wasm.yml
@@ -20,6 +35,8 @@ jobs:
     needs: [setup]
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare
       - name: Check formatting
         run:  dart format --set-exit-if-changed -o none .
@@ -42,6 +59,8 @@ jobs:
     needs: [setup]
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare
 
       - name: Install pana
@@ -57,6 +76,8 @@ jobs:
     needs: [setup]
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare
       - name: Test powersync package
         working-directory: packages/powersync

.github/workflows/prepare_wasm.yml

@@ -3,13 +3,17 @@ name: Build SQLite3 WASM
 on:
   workflow_call:
 
+permissions: {}
+
 jobs:
   compile_sqlite3_wasm:
     name: Compile sqlite3 wasm
     runs-on: macos-latest
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/cache@v5
         id: cache_build
         with:

.github/workflows/publish.yml

@@ -7,6 +7,8 @@ on:
       - "powersync_flutter_libs-v[0-9]+.[0-9]+.[0-9]+*"
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   setup:
     uses: ./.github/workflows/prepare_wasm.yml
@@ -16,38 +18,42 @@ jobs:
     if: "${{ startsWith(github.ref_name, 'powersync-') }}"
     needs: [setup]
     permissions:
-      contents: write
+      contents: write # Needed to create a release
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/prepare
       - name: Create Draft Release
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
         run: |
-          tag="${{ github.ref_name }}"
+          tag="${GITHUB_REF_NAME}"
           version="${tag#powersync-v}"
           changes=$(awk "/## $version/{flag=1;next}/##/{flag=0}flag" packages/powersync/CHANGELOG.md)
           body="Release $tag
           $changes"
           gh release create "$tag" --title "$tag" --notes "$body"
-          gh release upload "${{ github.ref_name }}" packages/powersync/assets/*.wasm
-          gh release upload "${{ github.ref_name }}" packages/powersync/assets/powersync_db.worker.js
+          gh release upload "${GITHUB_REF_NAME}" packages/powersync/assets/*.wasm
+          gh release upload "${GITHUB_REF_NAME}" packages/powersync/assets/powersync_db.worker.js
 
   publish_powersync:
     needs: [setup]
     permissions:
-      id-token: write
+      id-token: write # Needed to create an OIDC token for pub.dev
     if: "${{ startsWith(github.ref_name, 'powersync-') }}"
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
         uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       # Install Dart to install an OIDC token for publishing
       - uses: dart-lang/setup-dart@v1
       - name: Install Flutter
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
         with:
           flutter-version: "3.x"
           channel: "stable"
@@ -62,15 +68,15 @@ jobs:
 
   publish_powersync_flutter_libs:
     permissions:
-      id-token: write
+      id-token: write # Needed to create an OIDC token for pub.dev
     if: "${{ startsWith(github.ref_name, 'powersync_flutter_libs-') }}"
     uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1
     with:
       working-directory: packages/powersync_flutter_libs
 
   publish_powersync_attachments_helper:
     permissions:
-      id-token: write
+      id-token: write # Needed to create an OIDC token for pub.dev
     if: "${{ startsWith(github.ref_name, 'powersync_attachments_helper-') }}"
     uses: dart-lang/setup-dart/.github/workflows/publish.yml@v1
     with:

.github/zizmor.yaml

@@ -0,0 +1,15 @@
+# Configuration for https://zizmor.sh/, a static analysis tool for GitHub actions.
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "actions/*": ref-pin
+        "dart-lang/*": ref-pin
+        "Homebrew/actions/*": ref-pin
+  anonymous-definition:
+    disable: true
+  concurrency-limits:
+    ignore:
+      # We don't need to limit concurrency for publishing, as only maintainers can
+      # push tags.
+      - publish.yml:2:1