From e20b0f903dede0629556e092e60b182833836c29 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 10 Sep 2026 11:20:10 -0700 Subject: [PATCH 1/3] Seed new CLIs with the GitHub Actions audit job The seed's test workflow had no lint-actions job while every CLI seeded from it (basecamp-cli, hey-cli, fizzy-cli) and this repo's own test workflow run actionlint and zizmor on every push. A new CLI now starts with the same job, on zizmor-action 0.6.3, and with the actionlint config that lets 1.7.12 pass the `$/` reusable-workflow call the seed's release workflow makes (#74). --- seed/.github/actionlint.yaml | 10 ++++++++++ seed/.github/workflows/test.yml | 18 ++++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 seed/.github/actionlint.yaml diff --git a/seed/.github/actionlint.yaml b/seed/.github/actionlint.yaml new file mode 100644 index 0000000..05d90ee --- /dev/null +++ b/seed/.github/actionlint.yaml @@ -0,0 +1,10 @@ +# actionlint's rules for this repository. See https://github.com/rhysd/actionlint/blob/main/docs/config.md +paths: + .github/workflows/**/*.yml: + ignore: + # GitHub's self-repository `uses: $/...` syntax (July 2026) is what zizmor's + # self-repository audit asks for in place of `./...`, and what our reusable-workflow + # calls use. actionlint 1.7.12 predates it and has no release that knows it + # (rhysd/actionlint#711); drop this once one does. The ignore names the exact calls, + # so a new `$/` call is a deliberate edit here rather than a silent pass. + - 'reusable workflow call "\$/\.github/workflows/(security)\.yml" at "uses" is not following the format' diff --git a/seed/.github/workflows/test.yml b/seed/.github/workflows/test.yml index fa91764..cce7711 100644 --- a/seed/.github/workflows/test.yml +++ b/seed/.github/workflows/test.yml @@ -98,6 +98,24 @@ jobs: with: version: v2.9.0 + lint-actions: + name: GitHub Actions audit + runs-on: ubuntu-latest + permissions: + contents: read + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Run actionlint + uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12 + + - name: Run zizmor + uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3 + with: + advanced-security: false + security: name: Security runs-on: ubuntu-latest From f118eee024049d12e1f8fe3945666a326e5946af Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 10 Sep 2026 11:50:01 -0700 Subject: [PATCH 2/3] List the seed's actionlint config in the seed prompt's copy map A CLI bootstrapped from prompts/seed-cli.md copies the seed's .github tree file by file from the map in step 4. The map did not name seed/.github/actionlint.yaml, so a new CLI would get the lint-actions job without the config that lets actionlint 1.7.12 pass the $/ reusable-workflow call. --- prompts/seed-cli.md | 1 + 1 file changed, 1 insertion(+) diff --git a/prompts/seed-cli.md b/prompts/seed-cli.md index 487efff..e053143 100644 --- a/prompts/seed-cli.md +++ b/prompts/seed-cli.md @@ -100,6 +100,7 @@ You are creating a new Go CLI for a 37signals product using the seed templates. **GitHub infra (copy as-is unless .tmpl):** - `seed/.github/workflows/test.yml` → `.github/workflows/test.yml` (update env vars, GOPRIVATE) + - `seed/.github/actionlint.yaml` → `.github/actionlint.yaml` (the test workflow's lint-actions job reads it) - `seed/.github/workflows/security.yml` → `.github/workflows/security.yml` - `seed/.github/workflows/release.yml` → `.github/workflows/release.yml` (update env vars) - `seed/.github/workflows/dependabot-auto-merge.yml` → `.github/workflows/dependabot-auto-merge.yml` From 00d9ea79d3289e9dab10ceea5296d7ef70de8bfb Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Thu, 10 Sep 2026 11:59:23 -0700 Subject: [PATCH 3/3] List the seed's Scorecard workflow in the seed prompt's copy map seed/.github/workflows/scorecard.yml has been in the seed without an entry in the step-4 copy map, so a CLI bootstrapped from the prompt never got it. --- prompts/seed-cli.md | 1 + 1 file changed, 1 insertion(+) diff --git a/prompts/seed-cli.md b/prompts/seed-cli.md index e053143..e493b60 100644 --- a/prompts/seed-cli.md +++ b/prompts/seed-cli.md @@ -102,6 +102,7 @@ You are creating a new Go CLI for a 37signals product using the seed templates. - `seed/.github/workflows/test.yml` → `.github/workflows/test.yml` (update env vars, GOPRIVATE) - `seed/.github/actionlint.yaml` → `.github/actionlint.yaml` (the test workflow's lint-actions job reads it) - `seed/.github/workflows/security.yml` → `.github/workflows/security.yml` + - `seed/.github/workflows/scorecard.yml` → `.github/workflows/scorecard.yml` - `seed/.github/workflows/release.yml` → `.github/workflows/release.yml` (update env vars) - `seed/.github/workflows/dependabot-auto-merge.yml` → `.github/workflows/dependabot-auto-merge.yml` - `seed/.github/workflows/labeler.yml` → `.github/workflows/labeler.yml`