Fix Super Linter errors

.github/workflows/cicd.yml

@@ -10,8 +10,6 @@ on:
       - published
   workflow_dispatch:
 
-permissions: read-all
-
 env:
   DOTNET_NOLOGO: true
   DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
@@ -21,12 +19,18 @@ jobs:
   ci:
     name: CI
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      statuses: write
+      packages: read
     steps:
       - name: 'Checkout'
         uses: actions/checkout@v5
         with:
           lfs: true
           fetch-depth: 0
+          persist-credentials: false
       - name: 'Install InvokeBuild Module'
         shell: pwsh
         run: Install-Module -Name InvokeBuild -Force
@@ -63,12 +67,18 @@ jobs:
       name: 'DockerHub'
       url: https://hub.docker.com/r/tiksn/fossa-ui
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+      statuses: write
+      packages: read
     steps:
       - name: 'Checkout'
         uses: actions/checkout@v5
         with:
           lfs: true
           fetch-depth: 0
+          persist-credentials: false
       - name: 'Download Artefact'
         uses: actions/download-artifact@v5.0.0
         with:

.github/workflows/lint.yml

@@ -7,8 +7,6 @@ on:
   pull_request:
   workflow_dispatch:
 
-permissions: read-all
-
 env:
   DOTNET_NOLOGO: true
   DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true
@@ -20,13 +18,16 @@ jobs:
     runs-on: ubuntu-latest
 
     permissions:
+      contents: read
+      packages: read
       statuses: write
 
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 'Install InvokeBuild Module'
         shell: pwsh

.github/workflows/release-drafter.yml

@@ -12,7 +12,7 @@ on:
       - synchronize
   workflow_dispatch:
 
-permissions: read-all
+permissions: {}
 
 jobs:
   update_release_draft:

.trivyignore

@@ -0,0 +1,4 @@
+node_modules/
+**/node_modules/
+node_modules/**
+**/node_modules/**

lint.ps1

@@ -10,6 +10,7 @@ docker run --rm `
     -e FIX_DOTNET_SLN_FORMAT_STYLE=true `
     -e FIX_DOTNET_SLN_FORMAT_WHITESPACE=true `
     -e FIX_ENV=true `
+    -e FIX_GITHUB_ACTIONS_ZIZMOR=true `
     -e FIX_JAVASCRIPT_ES=true `
     -e FIX_JAVASCRIPT_PRETTIER=true `
     -e FIX_JSON=true `

trivy.yaml

@@ -0,0 +1,7 @@
+scan:
+  skip-dirs:
+    - 'node_modules'
+  skip-files:
+    - 'node_modules/**'
+    - '**/node_modules/**'
+    - '**/node_modules/**/*.Dockerfile'