From d0c052161a91c7b8eadc81ecc76974cfbce6a8a0 Mon Sep 17 00:00:00 2001
From: IzumiSy <beetle-noise@gmx.com>
Date: Fri, 2 Oct 2026 11:33:53 +0900
Subject: [PATCH 1/2] ci: lint GitHub Actions

---
 .github/workflows/lint-github-actions.yaml | 43 ++++++++++++++++++++++
 .github/workflows/publish.yml              | 16 +++++---
 .github/workflows/test.yml                 | 14 ++++---
 action.yml                                 |  2 +-
 aqua.yaml                                  |  9 +++++
 5 files changed, 72 insertions(+), 12 deletions(-)
 create mode 100644 .github/workflows/lint-github-actions.yaml
 create mode 100644 aqua.yaml

diff --git a/.github/workflows/lint-github-actions.yaml b/.github/workflows/lint-github-actions.yaml
new file mode 100644
index 0000000..5877672
--- /dev/null
+++ b/.github/workflows/lint-github-actions.yaml
@@ -0,0 +1,43 @@
+name: Lint GitHub Actions
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - ".github/workflows/**"
+      - "action.yml"
+      - "aqua.yaml"
+  pull_request:
+    paths:
+      - ".github/workflows/**"
+      - "action.yml"
+      - "aqua.yaml"
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: aquaproj/aqua-installer@96a9bc20066c5bf5e275b41019cfc165b25f4e2e # v4.0.5
+        with:
+          aqua_version: v2.62.3
+
+      - run: actionlint
+      - run: ghalint run
+      - run: ghalint run-action action.yml
+      - name: Run zizmor
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: zizmor --no-progress --collect=workflows,actions .
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 2575b77..8c38b78 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -5,19 +5,23 @@ on:
     branches: [main]
     paths: [package.json]
 
-permissions:
-  contents: read
-  id-token: write
+permissions: {}
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      id-token: write
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: package.json
           registry-url: https://registry.npmjs.org
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ba126c9..6323561 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -2,18 +2,22 @@ name: Test
 
 on: push
 
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   test:
     runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4.4.0
         with:
           run_install: false
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           cache: pnpm
           cache-dependency-path: ./pnpm-lock.yaml
diff --git a/action.yml b/action.yml
index 8c186b1..6330111 100644
--- a/action.yml
+++ b/action.yml
@@ -35,7 +35,7 @@ runs:
       run: git fetch origin ${{ github.base_ref }}
 
     - name: Setup Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version-file: "package.json"
 
diff --git a/aqua.yaml b/aqua.yaml
new file mode 100644
index 0000000..3027b5b
--- /dev/null
+++ b/aqua.yaml
@@ -0,0 +1,9 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/aquaproj/aqua/v2.62.3/json-schema/aqua-yaml.json
+registries:
+  - type: standard
+    ref: v4.553.0
+
+packages:
+  - name: rhysd/actionlint@v1.7.12
+  - name: suzuki-shunsuke/ghalint@v1.5.6
+  - name: zizmorcore/zizmor@v1.29.0

From fdc87732dee90b7cb461c82d4aa59c51302772dd Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 2 Oct 2026 02:37:36 +0000
Subject: [PATCH 2/2] ci: fix Actions lint failure

Co-authored-by: IzumiSy <982850+IzumiSy@users.noreply.github.com>
---
 action.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/action.yml b/action.yml
index 50aba16..a629018 100644
--- a/action.yml
+++ b/action.yml
@@ -36,7 +36,9 @@ runs:
   steps:
     - name: Fetch base branch
       shell: bash
-      run: git fetch origin ${{ github.base_ref }}
+      env:
+        BASE_REF: ${{ github.base_ref }}
+      run: git fetch origin "$BASE_REF"
 
     - name: Setup Node.js
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0