chore(ci): protect package installs with Aegis

.github/actions/install-dependencies/action.yml

@@ -5,7 +5,7 @@ runs:
   using: 'composite'
   steps:
     - name: Set up pnpm
-      uses: pnpm/action-setup@b307475762933b98ed359c036b0e51f26b63b74b # v5.0.0
+      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
 
     - name: Set up Node
       uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
@@ -15,4 +15,4 @@ runs:
 
     - name: Install dependencies
       shell: bash
-      run: pnpm install
+      run: pnpm install --frozen-lockfile

.github/workflows/audit-remediation-reusable.yml

@@ -67,8 +67,12 @@ jobs:
       actions: read
       contents: write
       pull-requests: write
+      id-token: write
     runs-on: ubuntu-latest
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -86,7 +90,7 @@ jobs:
           node-version: ${{ inputs['node-version'] }}
 
       - name: Install dependencies
-        run: ${{ inputs['install-command'] }}
+        run: ${{ inputs['install-command'] }} # zizmor: ignore[template-injection] This reusable workflow explicitly accepts shell commands from trusted callers, not event data.
 
       - name: Detect failed audit step
         id: detect

.github/workflows/audit-remediation.yml

@@ -3,7 +3,7 @@
 # before opening or updating a PR.
 name: Audit Remediation
 
-on:
+on: # zizmor: ignore[dangerous-triggers] Only failed same-repository main pushes trigger remediation of trusted main.
   workflow_run:
     workflows: [Main]
     types: [completed]
@@ -30,13 +30,16 @@ jobs:
       github.event_name == 'workflow_dispatch' ||
       (
         github.event.workflow_run.conclusion == 'failure' &&
+        github.event.workflow_run.event == 'push' &&
+        github.event.workflow_run.head_repository.full_name == github.repository &&
         github.event.workflow_run.head_branch == 'main' &&
         github.repository == 'wevm/mppx'
       )
     permissions:
       actions: read
       contents: write
       pull-requests: write
+      id-token: write
     uses: ./.github/workflows/audit-remediation-reusable.yml
     with:
       audit-command: pnpm audit --json --ignore-registry-errors

.github/workflows/conformance.yml

@@ -25,7 +25,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: tempoxyz/mpp-tools/.github/workflows/sdk-conformance-policy.yml@main
+    uses: tempoxyz/mpp-tools/.github/workflows/sdk-conformance-policy.yml@802a943d2a14adb61c06919d059ae9e75b3d5acb
     with:
       protocol-paths: |
         src/**
@@ -37,7 +37,7 @@ jobs:
     needs: conformance-policy
     permissions:
       contents: read
-    uses: tempoxyz/mpp-tools/.github/workflows/sdk-conformance.yml@main
+    uses: tempoxyz/mpp-tools/.github/workflows/sdk-conformance.yml@802a943d2a14adb61c06919d059ae9e75b3d5acb
     with:
       adapter: typescript
       conformance-ref: ${{ needs.conformance-policy.outputs.conformance_ref }}

.github/workflows/friction-log.yml

@@ -24,16 +24,20 @@ jobs:
       contents: write
       issues: write
       pull-requests: write
+      id-token: write
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           ref: ${{ github.sha }}
 
       - name: Report and reconcile frictions
-        uses: wevm/frog/action@242e306ebb19fbe77b6b3bcffcd9430743f5117a # v1
+        uses: wevm/frog/action@702c4eadefe175a208290a99c36e7f4ac1390e53 # v1
         with:
           issue-author: github-actions[bot]
           version: 1.0.15

.github/workflows/main.yml

@@ -14,6 +14,7 @@ jobs:
     name: Verify
     permissions:
       contents: read
+      id-token: write
     uses: ./.github/workflows/verify.yml
     secrets:
       VITE_STRIPE_SECRET_KEY: ${{ secrets.VITE_STRIPE_SECRET_KEY }}
@@ -33,6 +34,9 @@ jobs:
     timeout-minutes: 5
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -64,6 +68,9 @@ jobs:
     timeout-minutes: 5
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/prerelease.yml

@@ -12,8 +12,14 @@ jobs:
     name: Build
     if: github.repository == 'wevm/mppx'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.github/workflows/pull-request.yml

@@ -14,6 +14,7 @@ jobs:
     name: Verify
     permissions:
       contents: read
+      id-token: write
     uses: ./.github/workflows/verify.yml
     secrets:
       VITE_STRIPE_SECRET_KEY: ${{ secrets.VITE_STRIPE_SECRET_KEY }}

.github/workflows/scan-github-actions.yml

@@ -0,0 +1,19 @@
+name: Scan GitHub Actions
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  scan:
+    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@b35994a23aaf6acf4d5e2f91d18235a6e2f90e95 # 2026-09-23T08-07-21Z-b35994a2
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    with:
+      secure-runner-fail-on-violation: false

.github/workflows/scorecard.yml

@@ -14,7 +14,7 @@
 permissions: read-all
 
 jobs:
   analysis:
     name: Scorecard analysis
     runs-on: ubuntu-latest
     # `publish_results: true` only works when run from the default branch. conditional can be removed if disabled.
@@ -46,6 +46,6 @@
           retention-days: 5
 
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@80cb6b56b93de3e779c7d476d9100d06fb87c877 # codeql-bundle-v2.23.2
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif

.github/workflows/verify.yml

@@ -12,7 +12,7 @@
   contents: read
 
 jobs:
   ci-gate:
     name: CI Gate
     if: always()
     needs: [checks, test, test-html, test-x402-e2e]
@@ -27,8 +27,14 @@
   checks:
     name: Checks
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -62,7 +68,7 @@
       - name: Check package contents and size
         run: pnpm check:package
 
   test:
     name: Test Runtime
     if: always()
     needs: [test-runtime]
@@ -77,6 +83,9 @@
   test-runtime:
     name: Test Runtime / ${{ matrix.name }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     timeout-minutes: 12
     strategy:
       fail-fast: false
@@ -97,6 +106,9 @@
       TESTCONTAINERS_RYUK_DISABLED: true
       VITE_TEMPO_TAG: latest
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -117,7 +129,7 @@
       - name: Resolve Tempo image digest
         id: tempo-digest
         run: |
-          digest=$(docker buildx imagetools inspect ghcr.io/tempoxyz/tempo:${VITE_TEMPO_TAG} --raw | sha256sum | cut -d' ' -f1)
+          digest=$(docker buildx imagetools inspect "ghcr.io/tempoxyz/tempo:${VITE_TEMPO_TAG}" --raw | sha256sum | cut -d' ' -f1)
           echo "digest=${digest}" >> "$GITHUB_OUTPUT"
 
       - name: Cache Tempo Docker image
@@ -134,16 +146,16 @@
       - name: Pull and cache Tempo image
         if: steps.docker-cache.outputs.cache-hit != 'true'
         run: |
-          docker pull ghcr.io/tempoxyz/tempo:${VITE_TEMPO_TAG}
-          docker save ghcr.io/tempoxyz/tempo:${VITE_TEMPO_TAG} -o /tmp/tempo-image.tar
+          docker pull "ghcr.io/tempoxyz/tempo:${VITE_TEMPO_TAG}"
+          docker save "ghcr.io/tempoxyz/tempo:${VITE_TEMPO_TAG}" -o /tmp/tempo-image.tar
 
       - name: Start Tempo localnet
         run: |
           docker rm -f mppx-tempo-localnet 2>/dev/null || true
           docker run -d \
             --name mppx-tempo-localnet \
             -p 18545:54515 \
-            ghcr.io/tempoxyz/tempo:${VITE_TEMPO_TAG} \
+            "ghcr.io/tempoxyz/tempo:${VITE_TEMPO_TAG}" \
             node \
             --authrpc.port 54545 \
             --datadir /tmp/mppx-tempo-localnet \
@@ -163,7 +175,7 @@
             --port 54525 \
             --ws.port 54535
 
-          for attempt in {1..30}; do
+          for _attempt in {1..30}; do
             if curl -fsS \
               -H 'content-type: application/json' \
               --data '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}' \
@@ -228,13 +240,19 @@
   test-x402-e2e:
     name: Test x402 E2E
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     timeout-minutes: 12
     env:
       TESTCONTAINERS_RYUK_DISABLED: true
       VITE_TEMPO_NETWORK: none
       X402_ANVIL_RPC_URL: http://127.0.0.1:18546
       X402_LOCALNET: true
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -262,7 +280,7 @@
             --chain-id 31337 \
             --mnemonic 'test test test test test test test test test test test junk'
 
-          for attempt in {1..30}; do
+          for _attempt in {1..30}; do
             if curl -fsS \
               -H 'content-type: application/json' \
               --data '{"jsonrpc":"2.0","id":1,"method":"eth_chainId","params":[]}' \
@@ -295,8 +313,14 @@
   test-html:
     name: Test HTML
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     timeout-minutes: 15
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@117919c943b804057be733b0c4034c5542e58959 # 2026-09-23T05-09-41Z-117919c9
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:

.pinact.yaml

@@ -0,0 +1,17 @@
+version: 3
+rules:
+  # These repositories publish no release tags. Keep exceptions limited to
+  # these exact workflow paths and immutable SHAs; reassess when updating them.
+  # pinact skips verification, including release-age checks, for these pins.
+  - ignore: true
+    conditions:
+      - expr: ActionName == "tempoxyz/mpp-tools/.github/workflows/sdk-conformance-policy.yml" && ActionVersion == "802a943d2a14adb61c06919d059ae9e75b3d5acb"
+  - ignore: true
+    conditions:
+      - expr: ActionName == "tempoxyz/mpp-tools/.github/workflows/sdk-conformance.yml" && ActionVersion == "802a943d2a14adb61c06919d059ae9e75b3d5acb"
+  - ignore: true
+    conditions:
+      - expr: ActionName == "wevm/actions/.github/workflows/issue-labeled.yml" && ActionVersion == "f7ad7f00e16e73322562922c241f21f0c7ffbbec"
+  - ignore: true
+    conditions:
+      - expr: ActionName == "wevm/actions/.github/workflows/lock-issue.yml" && ActionVersion == "f7ad7f00e16e73322562922c241f21f0c7ffbbec"