chore: org-level cleanup — SHA pins, metrics branch, Zsh CI, CODEOWNERS

.github/CODEOWNERS

@@ -0,0 +1,16 @@
+# Default: TSC reviews everything
+*                               @z-shell/tsc
+
+# Composite actions
+/actions/                       @z-shell/tsc
+
+# Workflow files and templates
+/.github/workflows/             @z-shell/tsc
+/workflow-templates/            @z-shell/tsc
+
+# Org profile
+/profile/                       @z-shell/tsc
+
+# Configuration
+/.trunk/                        @z-shell/tsc
+/renovate-config.json           @z-shell/tsc

.github/dependabot.yml

@@ -1,27 +1,10 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
 version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
-    schedule:
-      interval: "daily"
-  - package-ecosystem: "docker"
-    directory: "/actions/rclone/"
-    schedule:
-      interval: "weekly"
-  - package-ecosystem: "docker"
-    directory: "/actions/verify-pr-labels/"
     schedule:
       interval: "weekly"
   - package-ecosystem: "docker"
-    directory: "/actions/mirror/"
-    schedule:
-      interval: "weekly"
-  - package-ecosystem: "docker"
-    directory: "/actions/rebase/"
+    directory: "/actions/rclone/"
     schedule:
       interval: "weekly"

.github/workflows/activity_metrics.yml

@@ -9,10 +9,14 @@ on:
     branches: [main]
     paths: [.github/workflows/activity_metrics.yml]
 
+permissions: {}
+
 jobs:
   metrics-activity:
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: write
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
@@ -30,6 +34,7 @@ jobs:
           token: ${{ secrets.ORG_TOKEN }}
           base: ""
           user: ${{ github.repository_owner }}
+          committer_branch: metrics
           plugin_projects: yes
           plugin_projects_descriptions: yes
           plugin_projects_limit: 10
@@ -39,6 +44,7 @@ jobs:
           token: ${{ secrets.ORG_TOKEN }}
           user: ${{ github.repository_owner }}
           base: ""
+          committer_branch: metrics
           template: repository
           repo: zi
           plugin_people: yes
@@ -49,6 +55,7 @@ jobs:
           token: ${{ secrets.ORG_TOKEN }}
           user: ${{ github.repository_owner }}
           base: ""
+          committer_branch: metrics
           template: repository
           repo: wiki
           plugin_people: yes
@@ -59,6 +66,7 @@ jobs:
           token: ${{ secrets.ORG_TOKEN }}
           user: ${{ github.repository_owner }}
           base: ""
+          committer_branch: metrics
           template: repository
           repo: F-Sy-H
           plugin_people: yes

.github/workflows/gh-push.yml

@@ -24,13 +24,13 @@ jobs:
       contents: write
       pages: write
     steps:
-      - name: "⤵️ Check out code from GitHub"
-        uses: actions/checkout@v4.2.2
+      - name: "⤵️ Check out metrics branch"
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          ref: metrics
           fetch-depth: 0
       - name: "🚀 Deploy Metrics to GitHub Pages"
-        if: github.ref == 'refs/heads/main'
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_branch: gh-pages

.github/workflows/lychee.yml

@@ -20,17 +20,22 @@ on:
       - "**.mdx"
       - "**.html"
 
+permissions: {}
+
 jobs:
   links-check:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
     concurrency:
       group: ${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v4.2.2
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: "📤 Restore cache"
         id: restore-cache
-        uses: actions/cache/restore@v3
+        uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: .lycheecache
           key: cache-lychee-${{ github.sha }}
@@ -48,15 +53,15 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
 
       - name: "📥 Save cache"
-        uses: actions/cache/save@v3
+        uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         if: always()
         with:
           path: .lycheecache
           key: ${{ steps.restore-cache.outputs.cache-primary-key }}
 
       - name: "🔖 Create Issue From File"
         if: env.lychee_exit_code != 0
-        uses: peter-evans/create-issue-from-file@v4
+        uses: peter-evans/create-issue-from-file@fca9117c27cdc29c6c4db3b86c48e4115a786710 # v6.0.0
         with:
           title: " 📢 Link Checker Report"
           content-filepath: ./.github/LINKS_REPORT.md

.github/workflows/metrics.yml

@@ -1,5 +1,6 @@
 ---
 name: "🌀 Z Metrics"
+
 on:
   schedule:
     - cron: "02 02 * * */2"
@@ -8,11 +9,15 @@ on:
     paths: [.github/workflows/metrics.yml]
   workflow_dispatch: {}
 
+permissions: {}
+
 jobs:
   metrics:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     environment: metrics
+    permissions:
+      contents: write
     concurrency:
       group: ci-${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
@@ -25,25 +30,28 @@ jobs:
       wiki_followup_svg: metrics/plugin/followup/wiki_followup.svg
       f-sy-h_followup_svg: metrics/plugin/followup/f-sy-h_followup.svg
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - uses: lowlighter/metrics@65836723097537a54cd8eb90f61839426b4266b6
         with:
           filename: ${{ env.metrics_svg }}
           token: ${{ secrets.ORG_TOKEN }}
           user: ${{ github.repository_owner }}
+          committer_branch: metrics
           base: header
       - uses: lowlighter/metrics@65836723097537a54cd8eb90f61839426b4266b6
         with:
           filename: ${{ env.repositories_metrics_svg }}
           token: ${{ secrets.ORG_TOKEN }}
           user: ${{ github.repository_owner }}
+          committer_branch: metrics
           base: repositories
       - uses: lowlighter/metrics@65836723097537a54cd8eb90f61839426b4266b6
         with:
           filename: ${{ env.stargazers_worldmap_svg }}
           token: ${{ secrets.ORG_TOKEN }}
           base: ""
           user: ${{ github.repository_owner }}
+          committer_branch: metrics
           plugin_stargazers: true
           plugin_stargazers_charts: no
           plugin_stargazers_worldmap: yes
@@ -54,6 +62,7 @@ jobs:
           token: ${{ secrets.ORG_TOKEN }}
           base: ""
           user: ${{ github.repository_owner }}
+          committer_branch: metrics
           plugin_followup: yes
           plugin_followup_indepth: yes
       - uses: lowlighter/metrics@65836723097537a54cd8eb90f61839426b4266b6
@@ -63,6 +72,7 @@ jobs:
           token: ${{ secrets.ORG_TOKEN }}
           user: ${{ github.repository_owner }}
           base: header, activity,community,repositories
+          committer_branch: metrics
           repo: zi
           plugin_followup: yes
       - uses: lowlighter/metrics@65836723097537a54cd8eb90f61839426b4266b6
@@ -72,6 +82,7 @@ jobs:
           token: ${{ secrets.ORG_TOKEN }}
           user: ${{ github.repository_owner }}
           base: header, activity,community,repositories
+          committer_branch: metrics
           repo: wiki
           plugin_followup: yes
       - uses: lowlighter/metrics@65836723097537a54cd8eb90f61839426b4266b6
@@ -81,5 +92,6 @@ jobs:
           token: ${{ secrets.ORG_TOKEN }}
           user: ${{ github.repository_owner }}
           base: header, activity,community,repositories
+          committer_branch: metrics
           repo: f-sy-h
           plugin_followup: yes

.github/workflows/pages-deployment.yaml → .github/workflows/pages-deployment.yml

@@ -1,10 +1,13 @@
 ---
 name: "🛳  Deploy CloudFlare Pages"
+
 on:
   push:
     branches: [main]
   workflow_dispatch: {}
 
+permissions: {}
+
 jobs:
   deploy:
     name: 🛳  Deploying
@@ -19,20 +22,20 @@ jobs:
       cancel-in-progress: true
     steps:
       - name: "⤵️  Check out code from GitHub"
-        uses: actions/checkout@v4.2.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: "📦 Setup pnpm"
-        uses: pnpm/action-setup@v4.1.0
+        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
       - name: "⎔  Setup node"
-        uses: actions/setup-node@v4.3.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
-          node-version: 18
+          node-version: lts/*
           cache: "pnpm"
       - name: "🏗  Build"
         run: pnpm install --prod && pnpm run build
       - name: "🚀 Publish"
-        uses: cloudflare/pages-action@v1.5.0
+        uses: cloudflare/pages-action@f0a1cd58cd66095dee69bfa18fa5efd1dde93bca # v1.5.0
         with:
           projectName: "zsh"
           directory: "build"

.github/workflows/pagespeed.yml

@@ -23,11 +23,12 @@ jobs:
       pagespeed_svg: metrics/plugin/pagespeed/detailed.svg
       pagespeed_url: ${{ secrets.PAGESPEED_TEST_URL }}
     steps:
-      - uses: lowlighter/metrics@v3.34
+      - uses: lowlighter/metrics@65836723097537a54cd8eb90f61839426b4266b6 # v3.34
         with:
           filename: ${{ env.pagespeed_svg }}
           token: NOT_NEEDED
           base: ""
+          committer_branch: metrics
           plugin_pagespeed: yes
           plugin_pagespeed_pwa: yes
           plugin_pagespeed_detailed: no