ci: add advisory scan lanes (actionlint, zizmor, gitleaks) + make lint-ci (#64)

A dedicated scans.yml (PR + main push + weekly cron) runs three log-only advisory jobs, mirroring the podman lane's model: continue-on-error and kept out of the ruleset's required checks. actionlint via rhysd's digest-pinned image; zizmor and gitleaks via first-party actions, SHA- and CLI-version-pinned, SARIF/comments disabled so the workflow needs only contents: read. make lint-ci mirrors the actionlint image locally. verify-ci-supplychain-unit.bats gains advisory/read-only guards plus a fleet-wide check that every workflow uses: stays SHA-pinned.

Author: Pyronewbic

.github/workflows/scans.yml

@@ -0,0 +1,51 @@
+# Advisory scanners: workflow linting (actionlint), workflow security posture (zizmor), and a
+# full-history secret sweep (gitleaks). Advisory = continue-on-error + NOT in the branch ruleset's
+# required checks - do NOT add these job names to the ruleset. Log-only by design: no SARIF upload,
+# no PR comments, so the whole workflow stays contents: read.
+name: advisory scans
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 6 * * 1" # weekly: scanner rules move even when the repo doesn't
+
+permissions:
+  contents: read # least privilege: log-only advisory
+
+jobs:
+  actionlint:
+    name: actionlint (advisory)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - name: Lint workflows (digest-pinned image; same ref as make lint-ci)
+        run: docker run --rm --platform linux/amd64 -v "$PWD:/repo" --workdir /repo rhysd/actionlint:1.7.12@sha256:9d36088643581e728c969f35141f88139fec77280b2be23c1f66f8e40e1025e7 -color
+
+  zizmor:
+    name: zizmor (advisory)
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        with:
+          version: "1.26.1" # pin the CLI too, not just the action
+          advanced-security: false # log-only: no SARIF upload (needs a write grant to the security tab)
+
+  gitleaks:
+    name: gitleaks (advisory)
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with: { fetch-depth: 0 } # full history - a leak in any past commit counts
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITLEAKS_ENABLE_COMMENTS: "false" # log-only: PR comments would need pull-requests + write

CONTRIBUTING.md

@@ -31,6 +31,7 @@ The suites are [bats-core](https://github.com/bats-core/bats-core), vendored as
 make test            # gate: CLI/init/install units + egress + security invariants (needs docker/podman)
 make test-nightly    # heavy suites: lock, learn, runtimes, nix, agents, control-plane
 make structure       # base-image invariants (no sudo, uid 1000, firewall packages) via container-structure-test
+make lint-ci         # advisory: actionlint over .github/workflows (mirrors the scans.yml lane)
 ```
 
 Each suite is `test/<name>.bats` (gate) or `test/nightly-<name>.bats` (heavy); shared helpers live in

Makefile

@@ -25,7 +25,7 @@ ENGINE_BATS   := $(ACCEPT_BATS) $(SECURITY_BATS)
 GATE_BATS     := $(UNIT_BATS) $(ENGINE_BATS)
 SRC := $(sort $(wildcard src/*.sh))
 
-.PHONY: test test-unit test-engine test-acceptance test-security test-nightly structure lint setup build build-check _bats-check
+.PHONY: test test-unit test-engine test-acceptance test-security test-nightly structure lint lint-ci setup build build-check _bats-check
 setup:
 	git submodule update --init --recursive
 _bats-check:
@@ -53,6 +53,10 @@ structure:
 lint:
 	shellcheck -S warning bin/sluice
 
+# advisory actionlint over .github/workflows - the same digest-pinned image as the scans.yml lane.
+lint-ci:
+	docker run --rm --platform linux/amd64 -v "$(CURDIR):/repo" --workdir /repo rhysd/actionlint:1.7.12@sha256:9d36088643581e728c969f35141f88139fec77280b2be23c1f66f8e40e1025e7 -color
+
 # bin/sluice is a GENERATED single-file launcher (assembled from the ordered src/*.sh slices, so the
 # curl-one-file install still works). Edit the slices, then `make build`.
 build:

test/verify-ci-supplychain-unit.bats

@@ -46,3 +46,31 @@ EOF
   run grep -F "if: matrix.suite == 'lock'" "$wf"
   assert_success
 }
+
+@test "supplychain: every scans.yml job is advisory (continue-on-error, never a required gate)" {
+  local wf="$ROOT/.github/workflows/scans.yml"
+  [ "$(grep -c 'runs-on:' "$wf")" = 3 ]
+  [ "$(grep -c 'continue-on-error: true' "$wf")" = 3 ]
+}
+
+@test "supplychain: scans.yml stays read-only (no SARIF/security-events, no write grants)" {
+  local wf="$ROOT/.github/workflows/scans.yml"
+  run grep -F 'security-events' "$wf"
+  assert_failure
+  run grep -F ': write' "$wf"
+  assert_failure
+  run grep -F 'contents: read' "$wf"
+  assert_success
+}
+
+@test "supplychain: every workflow action ref is SHA-pinned (fleet-wide)" {
+  run bash -c "grep -h 'uses:' \"$ROOT\"/.github/workflows/*.yml | grep -Ev '@[0-9a-f]{40}'"
+  assert_failure
+}
+
+@test "supplychain: make lint-ci runs the same digest-pinned actionlint image as scans.yml" {
+  local mk wf
+  mk="$(grep -o 'rhysd/actionlint:[^ ]*' "$ROOT/Makefile" | head -1)"
+  wf="$(grep -o 'rhysd/actionlint:[^ ]*' "$ROOT/.github/workflows/scans.yml" | head -1)"
+  [ -n "$mk" ] && [ "$mk" = "$wf" ]
+}