Provide GitHub Actions pinning and fix a bug

[lucperkins]

Pins GitHub Actions to commit SHAs, adds Dependabot to keep those pins current, and adds zizmor to check for unpinned actions and actionLint to catch thorny bugs going forward.

Fixing the fork guard

The publish steps were gated on !github.repository.fork. But github.repository is the owner/repo string, so .fork was always null and !null always true: the guard never blocked anything. All four steps now use github.event.repository.fork.

It guards pushes, not PRs. On a pull_request from a fork, github.event.repository is the base repo, so .fork is false there too — fork PRs are stopped by the github.ref check on the same line. What's newly covered is a push to a fork's own main.

Why actionlint, and why action-validator is gone

Neither of our existing checkers catches the bug above. action-validator validates workflow YAML against the SchemaStore JSON schema — it knows if: must be a string, but can't reason about what's inside ${{ }}, and exits clean on the broken file. zizmor covers security posture, not expression correctness.

actionlint type-checks expression contents against the real GitHub context types, and flags the broken guard on all four lines:

receiver of object dereference "fork" must be type of object but got "string" [expression]

It also runs shellcheck over run: blocks, pyflakes over inline Python, and validates action input/output names against each action's real metadata.

action-validator is dropped, not kept alongside. actionlint fully covers its remit. Given a workflow with a misspelled stpes:, a missing runs-on:, and a string where a number belongs, actionlint reports all three with clearer messages, e.g.:

unexpected key "stpes" for "job" section. expected one of "concurrency", ... [syntax-check]
"runs-on" section is missing in job "b" [syntax-check]

action-validator reports the same file by dumping a raw Rust ValidationState struct, and finds nothing actionlint misses.

zizmor stays. It and actionlint overlap on exactly one audit — script injection — and otherwise cover different ground. zizmor flags unpinned-uses and artipacked, which actionlint is silent on; supply-chain posture isn't its job, and expression typing isn't zizmor's. That leaves two tools split cleanly between correctness and security.

actionlint runs clean over both workflows today, with no shellcheck suppressions needed.

Summary by CodeRabbit

• Chores
  • Added weekly automated monitoring and grouped updates for GitHub Actions dependencies.
  • Improved workflow security by disabling credential persistence and pinning action references.
  • Added automated security checks for unpinned workflow actions.
  • Simplified development environment setup with a consolidated package set and updated formatting tools.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR updates GitHub Actions checkout settings, adds Dependabot and Zizmor policies, extends validation checks, and simplifies the Nix development shell and formatter configuration.

Changes

CI workflow security and validation

Layer / File(s)	Summary
Update workflow checkout and validation security checks .github/workflows/validate.yml, .github/workflows/workflow.yml	Checkout steps disable persisted credentials. The success job uses a pinned checkout commit. Validation names the action-validator and Prettier checks and adds a Zizmor check through nix develop.
Add action update and pin enforcement policies .github/dependabot.yml, .github/zizmor.yml	Dependabot checks GitHub Actions weekly, groups updates, ignores DeterminateSystems/*, and uses the ci commit prefix. Zizmor requires ref pinning for DeterminateSystems/* uses.
Consolidate flake inputs and development tools flake.nix	The flake removes nixpkgs-old, imports per-system pkgs from inputs.nixpkgs, consolidates shell packages, and uses pkgs.nixfmt as the formatter.

Estimated code review effort: 2 (Simple) | ~12 minutes

Possibly related PRs

• DeterminateSystems/ci#50: Modifies GitHub Actions references in the same workflow files, including actions/checkout and DeterminateSystems action references.

Suggested reviewers: colemickens

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies GitHub Actions pinning and the related bug fix, which match the main changes.
Description check	✅ Passed	The description clearly explains the pinning, tooling changes, fork guard fix, and rationale; it satisfies the repository template.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch actions-pinning

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/zizmor.yml:
- Around line 1-5: The policy sets DeterminateSystems/*: ref-pin but CI
workflows still reference DeterminateSystems/flakehub-cache-action@main; update
either the policy or the workflows so they agree—either change the policy in
.github/zizmor.yml (remove or narrow the ref-pin rule for DeterminateSystems/*)
or pin all uses of DeterminateSystems/flakehub-cache-action@main in
.github/workflows/validate.yml and .github/workflows/workflow.yml to fixed refs
(tags/SHAs) instead of `@main` so the ref-pin policy is satisfied.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: cce2c785-7303-4791-aa66-ca5732c80674

📥 Commits

Reviewing files that changed from the base of the PR and between 57a29b4 and e7676f3.

⛔ Files ignored due to path filters (1)

• flake.lock is excluded by !**/*.lock

📒 Files selected for processing (5)

• .github/dependabot.yml
• .github/workflows/validate.yml
• .github/workflows/workflow.yml
• .github/zizmor.yml
• flake.nix

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/workflow.yml:
- Line 174: Replace the invalid github.repository.fork guard with
github.event.repository.fork in all four workflow conditions at the publish-step
gates, including the condition shown near the visibility and branch/tag checks,
so fork runs remain excluded.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: c6c2e663-4cc2-4dc0-b1ec-4374f25bd9e4

📥 Commits

Reviewing files that changed from the base of the PR and between e7676f3 and e15d5de.

📒 Files selected for processing (2)

• .github/workflows/validate.yml
• .github/workflows/workflow.yml