From 8be4d21921d59a9bd317a80dc51166cf415bd20e Mon Sep 17 00:00:00 2001
From: Samuel Attard <sattard@anthropic.com>
Date: Fri, 25 Sep 2026 18:16:10 -0700
Subject: [PATCH 1/2] ci: pin actionlint and zizmor-action

The lint job couldn't start because zizmor-action was still referenced by a
placeholder, and org policy only allows actions pinned to a full commit SHA.
Pin zizmor-action to v0.6.4 and the actionlint image to 1.7.12 by digest.
---
 .github/workflows/ci.yml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eb09328..369514b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,18 +19,16 @@ jobs:
         with:
           persist-credentials: false
       # actionlint checks syntax and expression types, and runs shellcheck on
-      # `run:` blocks. <pin-me>: replace with the image digest for
-      # rhysd/actionlint:1.7.7.
+      # `run:` blocks. Pinned by tag and multi-arch image digest; update both
+      # together when bumping.
       - name: actionlint
         run: |
           docker run --rm -v "${GITHUB_WORKSPACE}:/repo" -w /repo \
-            rhysd/actionlint:1.7.7@sha256:<pin-me> -color
+            rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 -color
       # zizmor audits the workflows for security issues (unpinned actions,
-      # template injection, persisted credentials). <pin-me>: replace with the
-      # commit SHA of the zizmorcore/zizmor-action release you adopt, with the
-      # tag in a comment.
+      # template injection, persisted credentials).
       - name: zizmor
-        uses: zizmorcore/zizmor-action@<pin-me> # vX.Y.Z
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           advanced-security: false # print findings; no SARIF upload
 

From 62d17d2771b17e2e229c6ee87de15c1fc852a527 Mon Sep 17 00:00:00 2001
From: Samuel Attard <sattard@anthropic.com>
Date: Fri, 25 Sep 2026 18:25:27 -0700
Subject: [PATCH 2/2] ci: drop the unused context input from the deploy
 workflow

zizmor flags passing a workflow input straight into build-push-action's
context as template injection. Nothing sets the input, so build from the repo
root instead. Callers see no change, since the default was already ".".
---
 .github/workflows/deploy.yml | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index bbe665e..aadd770 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -28,15 +28,10 @@ on:
         type: string
         default: ''
       dockerfile:
-        description: Path to the Dockerfile, relative to `context`.
+        description: Path to the Dockerfile, relative to the repo root (the build context).
         required: false
         type: string
         default: ./Dockerfile
-      context:
-        description: Docker build context.
-        required: false
-        type: string
-        default: .
       platforms:
         description: buildx target platforms.
         required: false
@@ -105,7 +100,7 @@ jobs:
       - name: Build and push
         uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294
         with:
-          context: ${{ inputs.context }}
+          context: .
           file: ${{ inputs.dockerfile }}
           platforms: ${{ inputs.platforms }}
           push: true