root - chore: defense - lint workflows with zizmor

[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing guidelines and Code of Conduct
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)
CI / supply-chain hardening.

Summary

Adds .github/workflows/check-workflows.yaml so zizmor lints Actions workflows on every PR (defense-in-depth § 4).

Status update

DEFENSE_IN_DEPTH.md: zizmor check-workflows → (PR #71 pending); Socket Firewall → PR #70

Changes

• Add check-workflows with SHA-pinned checkout, Socket Firewall, and zizmorcore/zizmor-action
• Fork PRs use annotations instead of SARIF upload
• Reconcile Socket Firewall as merged in PR root - chore: defense - wrap installs with Socket Firewall #70

Verification

• Template copied from defense-in-depth-nodejs § 4 with firewall-version: 1.15.1
• npx actions-up -y --style sha --min-age 1
• CI on this PR: zizmor, tests (build-test 22/24/26), code-coverage (build), CodeQL

Reference

defense-in-depth-nodejs § 4

  

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[gemini-code-assist]

Code Review

This pull request updates the documentation in DEFENSE_IN_DEPTH.md and SECURITY.md to reflect that Socket Firewall (sfw) has been integrated to wrap pnpm install across CI jobs. I have no feedback to provide as there are no review comments or issues identified in these documentation updates.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (389503a) to head (9706008).

Additional details and impacted files

@@            Coverage Diff            @@
##              main       #71   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            3         3           
  Lines           19        19           
  Branches         1         1           
=========================================
  Hits            19        19           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T21:27:27.070467Z	9706008	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.