[ThePrismSystem]

Summary

Brings the workflows up to the baseline already running on handbells-used-chart-dorico-plugin, so that only a change that passes CI can reach main. The matching repository settings and rulesets are already applied (listed below), so this is the first PR to run under them. Phase E4 of bf-wivr, tracked in bf-phhj.

Changes

• Adds a Repo Scan job: zizmor audits the workflows and gitleaks scans the full history for secrets. Both are pinned release downloads verified against SHA-256. Either one fails the job on any finding, and both upload SARIF to code scanning (skipped for fork PRs, whose token cannot write there).
• Updates CodeQL to analyze the actions language alongside javascript-typescript, so the workflow files themselves are scanned. The check names become Analyze (actions) and Analyze (javascript-typescript).
• Updates both workflows to grant no token permissions at the top level and give each job only what it uses.
• Adds persist-credentials: false to every checkout, so the token is not left in .git/config on the self-hosted runners.
• Fixes the three codecov-action pin comments from # v7 to # v7.0.0, the tag that SHA points to.
• Updates Renovate: helpers:pinGitHubActionDigests; a 7-day minimum release age for every update except security fixes (dev dependencies were 3 days); platformCommit: enabled so its commits are signed under required_signatures; and a regex manager that moves each scanner's VERSION and SHA256 together.

Repository settings applied through the API alongside this PR (not in the diff):

• main ruleset: no bypass actors, 0 required approvals and no code-owner requirement, review threads must be resolved, a CodeQL code-scanning rule (security alerts high or higher, and errors), and every required check pinned to the app that posts it. Adds Repo Scan, codecov/patch and the two per-language Analyze checks.
• New release tags ruleset: v* tags cannot be deleted, force-pushed or moved.
• Immutable releases are on. The merge-commit and rebase buttons are off, leaving squash, which the ruleset already required. Projects is off.

The TypeScript analysis keeps the code-scanning category it used before the matrix (.github/workflows/codeql.yml:analyze). On a new category, code scanning could not compare a pull request against main, so the code-scanning rule blocked the merge, and dismissed alert #1 would have lost its dismissal.

Why

• Every PR from feat(web): let the project view create a bean #39 to fix(deps): clear accumulated security advisories and prepare 0.3.1 #53 merged with zero reviews through the admin bypass, and that bypass skips the required checks as well. With no bypass and no approval requirement, a merge with a failing check is blocked for everyone, the owner included. Merging still needs write access, which only the owner has.
• The self-hosted runners sit on the LAN, so a persisted token or an injectable workflow costs more here than on GitHub's runners. zizmor and the actions CodeQL queries look for those problems.
• Pinning each required check to its app stops another integration from posting a passing status under the same name.

Test Plan

• zizmor 1.31.1 reports no findings on either workflow (12 before: 9 checkouts persisting credentials, 3 mismatched pin comments)
• gitleaks 8.30.1 finds no leaks across the full history (178 commits)
• The new Renovate regex extracts both scanners' version and digest from ci.yml, and renovate-config-validator --strict passes
• Prettier, cspell and the pre-push typecheck, lint and test suite pass
• This PR's own checks pass, including the new Repo Scan and per-language Analyze jobs

To see the new gate:

• The merge box on this PR lists the 12 required checks and offers only "Squash and merge", with no option to bypass.
• Once Repo Scan has run, Security > Code scanning lists zizmor and gitleaks as tools next to CodeQL.
• Settings > Rules > Rulesets shows main with an empty bypass list and release tags targeting refs/tags/v*.

Review Checklist

• Tests pass locally
• No breaking changes (or documented in summary)
• Documentation updated if needed
• Error handling considered
• Security implications reviewed

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[codecov]

Bundle Report

Bundle size has no change ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!