From 69ce06bc1ee2fb6afc96049220968eec46de6bed Mon Sep 17 00:00:00 2001
From: Samuel Attard <sattard@anthropic.com>
Date: Thu, 2 Apr 2026 20:00:54 +0000
Subject: [PATCH 1/2] ci: fix zizmor audit findings

---
 .github/workflows/add-to-project.yml | 2 +-
 .github/workflows/auto-fix-lint.yml  | 2 +-
 .github/workflows/lint.yml           | 2 ++
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
index 05903d8..69e3a43 100644
--- a/.github/workflows/add-to-project.yml
+++ b/.github/workflows/add-to-project.yml
@@ -1,6 +1,6 @@
 name: Add to Ecosystem WG Project
 
-on:
+on: # zizmor: ignore[dangerous-triggers] needed to access app creds for fork PRs; no PR code is checked out
   issues:
     types:
       - opened
diff --git a/.github/workflows/auto-fix-lint.yml b/.github/workflows/auto-fix-lint.yml
index d370124..58fbdf7 100644
--- a/.github/workflows/auto-fix-lint.yml
+++ b/.github/workflows/auto-fix-lint.yml
@@ -22,7 +22,7 @@ jobs:
       with:
         creds: ${{ secrets.GH_APP_CREDS }}
         export-git-user: true
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # tag: v4.1.1
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # tag: v4.1.1 # zizmor: ignore[artipacked] persisted token is intentional; needed for the git push step below
       with:
         token: ${{ steps.generate-token.outputs.token }}
     - name: Setup Node.js
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ebd306b..2e621a8 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -20,6 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # tag: v4.1.1
+      with:
+        persist-credentials: false
     - name: Setup Node.js
       uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65  # tag: v4.0.0
       with:

From e8c1397928e92ac54d9873a84413efaf41533399 Mon Sep 17 00:00:00 2001
From: David Sanders <dsanders11@ucsbalum.com>
Date: Thu, 2 Apr 2026 14:14:34 -0700
Subject: [PATCH 2/2] chore: move comment

---
 .github/workflows/add-to-project.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
index 69e3a43..f53656b 100644
--- a/.github/workflows/add-to-project.yml
+++ b/.github/workflows/add-to-project.yml
@@ -1,10 +1,10 @@
 name: Add to Ecosystem WG Project
 
-on: # zizmor: ignore[dangerous-triggers] needed to access app creds for fork PRs; no PR code is checked out
+on:
   issues:
     types:
       - opened
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened