ci: protect package installs with Aegis

.github/actions/install-dependencies/action.yml

@@ -5,7 +5,7 @@ runs:
   using: 'composite'
   steps:
     - name: Set up pnpm
-      uses: pnpm/action-setup@b307475762933b98ed359c036b0e51f26b63b74b # v5.0.0
+      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
 
     - name: Set up Node
       uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
@@ -15,4 +15,4 @@ runs:
 
     - name: Install dependencies
       shell: bash
-      run: pnpm install
+      run: pnpm install --frozen-lockfile

.github/workflows/audit-remediation-reusable.yml

@@ -67,8 +67,12 @@ jobs:
       actions: read
       contents: write
       pull-requests: write
+      id-token: write
     runs-on: ubuntu-latest
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -86,7 +90,7 @@ jobs:
           node-version: ${{ inputs['node-version'] }}
 
       - name: Install dependencies
-        run: ${{ inputs['install-command'] }}
+        run: ${{ inputs['install-command'] }} # zizmor: ignore[template-injection] This reusable workflow explicitly accepts shell commands from trusted callers, not event data.
 
       - name: Detect failed audit step
         id: detect

.github/workflows/audit-remediation.yml

@@ -3,7 +3,7 @@
 # before opening or updating a PR.
 name: Audit Remediation
 
-on:
+on: # zizmor: ignore[dangerous-triggers] Only failed same-repository main pushes trigger remediation of trusted main.
   workflow_run:
     workflows: [Main]
     types: [completed]
@@ -30,13 +30,16 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       (
         github.event.workflow_run.conclusion == 'failure' &&
+        github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.head_repository.full_name == github.repository &&
         github.event.workflow_run.head_branch == 'main' &&
         github.repository == 'wevm/mppx'
       )
     permissions:
       actions: read
       contents: write
       pull-requests: write
+      id-token: write
     uses: ./.github/workflows/audit-remediation-reusable.yml
     with:
       audit-command: pnpm audit --json --ignore-registry-errors

.github/workflows/conformance.yml

@@ -28,7 +28,7 @@ jobs:
       contents: read
       id-token: write
       pull-requests: read
-    uses: tempoxyz/mpp-tools/.github/workflows/sdk-conformance-policy.yml@main
+    uses: tempoxyz/mpp-tools/.github/workflows/sdk-conformance-policy.yml@280f74c141024ca1e1578758a43bba9e96eb86ad # zizmor: ignore[ref-version-mismatch] mpp-tools publishes no tags for these pins.
     with:
       protocol-paths: |
         src/**
@@ -41,7 +41,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: tempoxyz/mpp-tools/.github/workflows/sdk-conformance.yml@main
+    uses: tempoxyz/mpp-tools/.github/workflows/sdk-conformance.yml@280f74c141024ca1e1578758a43bba9e96eb86ad # zizmor: ignore[ref-version-mismatch] mpp-tools publishes no tags for these pins.
     with:
       adapter: typescript
       conformance-ref: ${{ needs.conformance-policy.outputs.conformance_ref }}

.github/workflows/friction-log.yml

@@ -24,16 +24,20 @@ jobs:
       contents: write
       issues: write
       pull-requests: write
+      id-token: write
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ github.sha }}
 
       - name: Report and reconcile frictions
-        uses: wevm/frog/action@242e306ebb19fbe77b6b3bcffcd9430743f5117a # v1
+        uses: wevm/frog/action@702c4eadefe175a208290a99c36e7f4ac1390e53 # v1
         with:
           issue-author: github-actions[bot]
           version: 1.0.15

.github/workflows/main.yml

@@ -14,6 +14,7 @@ jobs:
     name: Verify
     permissions:
       contents: read
+      id-token: write
     uses: ./.github/workflows/verify.yml
     secrets:
       VITE_STRIPE_SECRET_KEY: ${{ secrets.VITE_STRIPE_SECRET_KEY }}
@@ -28,10 +29,14 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+      id-token: write
     runs-on: ubuntu-latest
     timeout-minutes: 5
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -70,6 +75,9 @@ jobs:
     timeout-minutes: 5
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -112,6 +120,9 @@ jobs:
     timeout-minutes: 5
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/pr-audit.yml

@@ -79,8 +79,13 @@ jobs:
   # Manual audits keep their optional SHA override.
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     if: github.event_name == 'workflow_dispatch'
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Resolve manual target SHA
         if: github.event_name == 'workflow_dispatch'
         id: resolve_manual_target

.github/workflows/prerelease.yml

@@ -11,9 +11,15 @@ jobs:
   build:
     name: Build
     if: github.repository == 'wevm/mppx'
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ubuntu-latest
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/pull-request.yml

@@ -14,6 +14,7 @@ jobs:
     name: Verify
     permissions:
       contents: read
+      id-token: write
     uses: ./.github/workflows/verify.yml
     secrets:
       VITE_STRIPE_SECRET_KEY: ${{ secrets.VITE_STRIPE_SECRET_KEY }}

.github/workflows/rebalance-test-shards.yml

@@ -15,6 +15,7 @@ jobs:
     if: github.repository == 'wevm/mppx' && github.ref == 'refs/heads/main'
     permissions:
       contents: read
+      id-token: write
     uses: ./.github/workflows/verify.yml
     secrets:
       VITE_STRIPE_SECRET_KEY: ${{ secrets.VITE_STRIPE_SECRET_KEY }}
@@ -28,7 +29,11 @@ jobs:
       actions: read
       contents: write
       pull-requests: write
+      id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/scan-github-actions.yml

@@ -0,0 +1,23 @@
+name: Scan GitHub Actions
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  scan:
+    name: Scan GitHub Actions
+    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    with:
+      # Scorecard's analysis job can't start with secure-runner: publish_results only accepts
+      # an allowlist of actions (checkout, harden-runner, upload-artifact, upload-sarif), so the
+      # check reports it without failing. Every other job starts with secure-runner.
+      secure-runner-fail-on-violation: false

.github/workflows/scorecard.yml

@@ -14,7 +14,7 @@
 permissions: read-all
 
 jobs:
   analysis:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
@@ -46,6 +46,6 @@
           retention-days: 5
 
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@80cb6b56b93de3e779c7d476d9100d06fb87c877 # codeql-bundle-v2.23.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

.github/workflows/verify.yml

@@ -17,7 +17,13 @@ jobs:
     if: always()
     needs: [checks, test, test-html, test-x402-e2e]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - run: |
           if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
             echo "One or more required jobs failed or were cancelled"
@@ -26,9 +32,15 @@ jobs:
 
   checks:
     name: Checks
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ubuntu-latest
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -67,7 +79,13 @@ jobs:
     if: always()
     needs: [test-runtime]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - run: |
           if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
             echo "One or more runtime test shards failed or were cancelled"
@@ -76,6 +94,9 @@ jobs:
 
   test-runtime:
     name: Test Runtime / ${{ matrix.name }}
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ubuntu-latest
     timeout-minutes: 12
     strategy:
@@ -118,6 +139,9 @@ jobs:
       TESTCONTAINERS_RYUK_DISABLED: true
       VITE_TEMPO_TAG: latest
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -133,7 +157,7 @@ jobs:
             docker run -d \
               --name mppx-tempo-localnet \
               -p 18545:54515 \
-              ghcr.io/tempoxyz/tempo:${VITE_TEMPO_TAG} \
+              "ghcr.io/tempoxyz/tempo:${VITE_TEMPO_TAG}" \
               node \
               --authrpc.port 54545 \
               --datadir /tmp/mppx-tempo-localnet \
@@ -170,7 +194,7 @@ jobs:
       - name: Wait for Tempo localnet
         if: matrix.tempo
         run: |
-          for attempt in {1..90}; do
+          for _attempt in {1..90}; do
             if curl -fsS \
               -H 'content-type: application/json' \
               --data '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}' \
@@ -237,6 +261,9 @@ jobs:
 
   test-x402-e2e:
     name: Test x402 E2E / ${{ matrix.name }}
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ubuntu-latest
     timeout-minutes: 12
     strategy:
@@ -253,6 +280,9 @@ jobs:
       X402_ANVIL_RPC_URL: http://127.0.0.1:18546
       X402_LOCALNET: true
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -277,7 +307,7 @@ jobs:
             --chain-id 31337 \
             --mnemonic 'test test test test test test test test test test test junk'
 
-          for attempt in {1..30}; do
+          for _attempt in {1..30}; do
             if curl -fsS \
               -H 'content-type: application/json' \
               --data '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}' \
@@ -308,9 +338,15 @@ jobs:
 
   test-html:
     name: Test HTML
+    permissions:
+      contents: read
+      id-token: write
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@35019557465e3c38ee3468be171771fd73577584 # 2026-10-20T06-22-38Z-35019557
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/zizmor.yml

@@ -0,0 +1,5 @@
+rules:
+  # actionlint does not support the $/ self-repository syntax yet, so local
+  # actions and reusable workflows keep their ./ references.
+  self-repository:
+    disable: true

.pinact.yaml

@@ -0,0 +1,17 @@
+version: 3
+rules:
+  # These repositories publish no release tags. Keep exceptions limited to
+  # these exact workflow paths and immutable SHAs; reassess when updating them.
+  # pinact skips verification, including release-age checks, for these pins.
+  - ignore: true
+    conditions:
+      - expr: ActionName == "tempoxyz/mpp-tools/.github/workflows/sdk-conformance-policy.yml" && ActionVersion == "280f74c141024ca1e1578758a43bba9e96eb86ad"
+  - ignore: true
+    conditions:
+      - expr: ActionName == "tempoxyz/mpp-tools/.github/workflows/sdk-conformance.yml" && ActionVersion == "280f74c141024ca1e1578758a43bba9e96eb86ad"
+  - ignore: true
+    conditions:
+      - expr: ActionName == "wevm/actions/.github/workflows/issue-labeled.yml" && ActionVersion == "f7ad7f00e16e73322562922c241f21f0c7ffbbec"
+  - ignore: true
+    conditions:
+      - expr: ActionName == "wevm/actions/.github/workflows/lock-issue.yml" && ActionVersion == "f7ad7f00e16e73322562922c241f21f0c7ffbbec"