Merge pull request #18 from Progmasoft/ci/analysis-tools

Add workflow analysis and hand version updates to Renovate

5 files changed, 92 insertions, 18 deletions

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index b19178a..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,18 +0,0 @@
-# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
-# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
-
-version: 2
-updates:
-  - package-ecosystem: github-actions
-    directory: /
-    schedule:
-      interval: weekly
-  - package-ecosystem: npm
-    directory: /frontend
-    schedule:
-      interval: weekly
-  - package-ecosystem: gradle
-    directory: /backend
-    schedule:
-      interval: weekly
-
diff --git a/.github/renovate.json5 b/.github/renovate.json5
new file mode 100644
index 0000000..6d8623b
--- /dev/null
+++ b/.github/renovate.json5
@@ -0,0 +1,46 @@
+// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+// SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+// Renovate proposes the version updates of this repository. Dependabot keeps
+// its alerts and its security updates, which are repository settings; its
+// version updates are off, so that two bots do not open the same pull
+// request.
+{
+  $schema: "https://docs.renovatebot.com/renovate-schema.json",
+  extends: ["config:recommended", "helpers:pinGitHubActionDigests"],
+
+  timezone: "Europe/Istanbul",
+  // Once a week, before the working day.
+  schedule: ["before 6am on monday"],
+
+  // A release is taken a week after it is published: one that turns out to
+  // be broken or malicious is usually withdrawn within days.
+  minimumReleaseAge: "7 days",
+
+  // A pull request is rebased when it conflicts, not whenever the default
+  // branch moves, so that a merge does not start the tests of every open
+  // update again.
+  rebaseWhen: "conflicted",
+  prConcurrentLimit: 2,
+  prHourlyLimit: 2,
+
+  // One issue lists what is pending, so an update need not be a pull request
+  // to be seen.
+  dependencyDashboard: true,
+
+  // Security fixes come from Dependabot security updates. Renovate does not
+  // open its own for the same advisory.
+  vulnerabilityAlerts: { enabled: false },
+
+  ignorePaths: ["**/node_modules/**"],
+
+  // What Dependabot watched here, and nothing more for now.
+  enabledManagers: ["github-actions", "npm", "gradle", "gradle-wrapper"],
+
+  // One pull request for each kind of dependency.
+  packageRules: [
+    { matchManagers: ["github-actions"], groupName: "GitHub Actions" },
+    { matchManagers: ["npm"], groupName: "Frontend packages" },
+    { matchManagers: ["gradle", "gradle-wrapper"], groupName: "Backend plugins and libraries" },
+  ],
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f6db466..70631c6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,6 +21,8 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
@@ -50,6 +52,8 @@ jobs:
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
@@ -119,4 +123,6 @@ jobs:
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0b29f44..c5dde81 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,6 +29,8 @@ jobs:
             build_mode: manual
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         if: matrix.language == 'java-kotlin'
         with:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..ee34012
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,38 @@
+# SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
+# SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
+
+name: Workflow Security
+
+# zizmor reads the workflows of this repository for what makes a workflow
+# unsafe: a token that is wider than its job needs, text from a pull request
+# that reaches a shell, an action that is not pinned. Its findings are
+# uploaded to code scanning.
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+
+      - name: Audit the workflows
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4