From 7ce84f7d2e6221d5ed8bfed4da3aeb9d76131958 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Bru=C5=BEina?= <martin@bruzina.cz>
Date: Sat, 1 Aug 2026 13:07:19 +0200
Subject: [PATCH 1/5] fix(megalinter): whitelist github_token for zizmor

---
 .mega-linter.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.mega-linter.yml b/.mega-linter.yml
index 1d9f34c..1472327 100644
--- a/.mega-linter.yml
+++ b/.mega-linter.yml
@@ -2,6 +2,8 @@
 ENABLE:
   - ACTION
   - MARKDOWN
+ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
+  - GITHUB_TOKEN
 # CHANGELOG.md is generated by semantic-release
 MARKDOWN_FILTER_REGEX_EXCLUDE: "(CHANGELOG\\.md)"
 SHOW_ELAPSED_TIME: true

From 301909533df20b2fcd3299956cfe4301266e6102 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Bru=C5=BEina?= <martin@bruzina.cz>
Date: Sat, 1 Aug 2026 13:07:27 +0200
Subject: [PATCH 2/5] fix(semantic-release): pass additional plugins via array

---
 .github/workflows/semantic-release.yaml | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/semantic-release.yaml b/.github/workflows/semantic-release.yaml
index fc4f654..5ea3132 100644
--- a/.github/workflows/semantic-release.yaml
+++ b/.github/workflows/semantic-release.yaml
@@ -50,15 +50,9 @@ jobs:
       - name: Install Semantic Release
         env:
           SEMANTIC_RELEASE_PLUGINS: ${{ inputs.semantic_release_plugins }}
-        run: >
-          npm install
-          --ignore-scripts
-          semantic-release
-          conventional-changelog-conventionalcommits
-          @semantic-release/changelog
-          @semantic-release/git
-          semantic-release-major-tag
-          $SEMANTIC_RELEASE_PLUGINS
+        run: |
+          mapfile -t plugins <<< "$SEMANTIC_RELEASE_PLUGINS"
+          npm install --ignore-scripts semantic-release conventional-changelog-conventionalcommits @semantic-release/changelog @semantic-release/git semantic-release-major-tag "${plugins[@]}"
       - name: Verify Semantic Release
         run: npm audit signatures
       - name: Run Semantic Release

From 6d322d8a92a19d46347dcb9af11f08132facd201 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Bru=C5=BEina?= <martin@bruzina.cz>
Date: Sat, 1 Aug 2026 13:07:33 +0200
Subject: [PATCH 3/5] fix(megalinter): allow major tag pinning

---
 zizmor.yaml | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 zizmor.yaml

diff --git a/zizmor.yaml b/zizmor.yaml
new file mode 100644
index 0000000..bbb0366
--- /dev/null
+++ b/zizmor.yaml
@@ -0,0 +1,6 @@
+---
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin

From 054dc4e6559f2dab108b95938ba5b892e046f9f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Bru=C5=BEina?= <martin@bruzina.cz>
Date: Sat, 1 Aug 2026 13:07:40 +0200
Subject: [PATCH 4/5] fix(semantic-release): scope github app token and
 credentials

---
 .github/workflows/semantic-release.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/semantic-release.yaml b/.github/workflows/semantic-release.yaml
index 5ea3132..43872e6 100644
--- a/.github/workflows/semantic-release.yaml
+++ b/.github/workflows/semantic-release.yaml
@@ -38,11 +38,16 @@ jobs:
         with:
           app-id: ${{ inputs.GH_SEM_REL_APP_ID }}
           private-key: ${{ secrets.GH_SEM_REL_APP_PEM_FILE }}
+          repositories: ${{ github.repository }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
           token: ${{ steps.gh-app-token.outputs.token || secrets.GITHUB_TOKEN }}
           fetch-depth: 0
+          persist-credentials: true
       - name: Set up Node.js
         uses: actions/setup-node@v7
         with:

From 6af3dd78c264dd68c69edec26d3d625c80875357 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Martin=20Bru=C5=BEina?= <martin@bruzina.cz>
Date: Sat, 1 Aug 2026 13:07:47 +0200
Subject: [PATCH 5/5] fix(megalinter): disable persisted checkout credentials

---
 .github/workflows/megalinter.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/megalinter.yaml b/.github/workflows/megalinter.yaml
index 1a6dba1..7cb2804 100644
--- a/.github/workflows/megalinter.yaml
+++ b/.github/workflows/megalinter.yaml
@@ -25,6 +25,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.head_ref || '' }}
+          persist-credentials: false
       - name: MegaLinter
         uses: oxsecurity/megalinter/flavors/documentation@v9
         env: