Add zizmor CI & make it happy (#2877)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

.github/workflows/backport.yml

@@ -1,6 +1,8 @@
 name: Backport
 on:
-    pull_request_target:
+    # Privilege escalation necessary to enable backporting PRs from forks
+    # 🚨 We must not execute any checked out code here.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
         types:
             - closed
             - labeled

.github/workflows/build_and_deploy.yaml

@@ -79,7 +79,7 @@ jobs:
             matrix:
                 arch: [x64, arm64]
         uses: ./.github/workflows/build_windows.yaml
-        secrets: inherit
+        secrets: inherit # zizmor: ignore[secrets-inherit]
         with:
             sign: true
             arch: ${{ matrix.arch }}
@@ -90,7 +90,7 @@ jobs:
         needs: prepare
         name: macOS
         uses: ./.github/workflows/build_macos.yaml
-        secrets: inherit
+        secrets: inherit # zizmor: ignore[secrets-inherit]
         with:
             sign: true
             base-url: https://packages.element.io/${{ needs.prepare.outputs.packages-dir }}
@@ -122,7 +122,7 @@ jobs:
         environment: ${{ needs.prepare.outputs.deploy == 'true' && 'packages.element.io' || '' }}
         steps:
             - name: Download artifacts
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
 
             - name: Prepare artifacts for deployment
               run: |
@@ -212,7 +212,7 @@ jobs:
 
             - name: Stash packages.element.io
               if: needs.prepare.outputs.deploy == 'false'
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
               with:
                   name: packages.element.io
                   path: packages.element.io
@@ -250,7 +250,7 @@ jobs:
 
             - name: Stash debs
               if: needs.prepare.outputs.deploy == 'false' && needs.linux.result == 'success'
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
               with:
                   name: debs
                   path: |
@@ -258,7 +258,7 @@ jobs:
                       ${{ steps.deb.outputs.arm64 }}
 
             - name: Publish amd64 deb to packages.element.io
-              uses: element-hq/packages.element.io@master
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
               if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
               with:
                   file: ${{ steps.deb.outputs.amd64 }}
@@ -268,7 +268,7 @@ jobs:
                   bucket-access-key: ${{ secrets.CF_R2_TOKEN }}
 
             - name: Publish arm64 deb to packages.element.io
-              uses: element-hq/packages.element.io@master
+              uses: element-hq/packages.element.io@master # zizmor: ignore[unpinned-uses]
               if: needs.prepare.outputs.deploy == 'true' && needs.linux.result == 'success'
               with:
                   file: ${{ steps.deb.outputs.arm64 }}
@@ -289,14 +289,14 @@ jobs:
             id-token: write # This is required for requesting the JWT
         steps:
             - name: Configure AWS credentials
-              uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
+              uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6
               with:
                   role-to-assume: arn:aws:iam::264135176173:role/Push-ElementDesktop-MSI
                   role-session-name: githubaction-run-${{ github.run_id }}
                   aws-region: ${{ env.AWS_REGION }}
 
             - name: Download artifacts
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
               with:
                   pattern: win-*
 

.github/workflows/build_and_test.yaml

@@ -53,7 +53,9 @@ jobs:
         runs-on: ubuntu-24.04
         if: ${{ !cancelled() }}
         steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -65,7 +67,7 @@ jobs:
               run: pnpm install --frozen-lockfile
 
             - name: Download blob reports from GitHub Actions Artifacts
-              uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+              uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
               with:
                   pattern: blob-report-*
                   path: all-blob-reports
@@ -76,7 +78,7 @@ jobs:
 
             - name: Upload HTML report
               if: always()
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
               with:
                   name: html-report
                   path: playwright-report

.github/workflows/build_linux.yaml

@@ -105,12 +105,13 @@ jobs:
                         }
                       }
 
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
                   repository: element-hq/element-desktop
                   ref: ${{ inputs.ref }}
+                  persist-credentials: false
 
-            - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+            - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
               with:
                   name: ${{ inputs.prepare-artifact-name }}
 
@@ -144,7 +145,7 @@ jobs:
 
             # This allows contributors to test changes to the dockerbuild image within a pull request
             - name: Build docker image
-              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
               if: steps.changed_files.outputs.any_modified == 'true'
               with:
                   file: dockerbuild/Dockerfile
@@ -184,13 +185,15 @@ jobs:
                   fi
 
             - name: Build App
-              run: pnpm build --publish never ${{ steps.config.outputs.build-args }} -l ${{ inputs.targets }}
+              run: pnpm build --publish never $BUILD_ARGS -l $TARGETS
               env:
                   VARIANT_PATH: variant.json
                   # Only set for Nightly builds
                   VERSION: ${{ inputs.version }}
                   # Workaround for https://github.com/electron-userland/electron-builder/issues/5721
                   USE_HARD_LINKS: false
+                  BUILD_ARGS: ${{ steps.config.outputs.build-args }}
+                  TARGETS: ${{ inputs.targets }}
 
             - name: Check native libraries
               run: |
@@ -220,7 +223,7 @@ jobs:
 
             # We exclude *-unpacked as it loses permissions and the tarball contains it with correct permissions
             - name: Upload Artifacts
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
               with:
                   name: ${{ inputs.artifact-prefix }}linux-${{ inputs.arch }}-sqlcipher-${{ inputs.sqlcipher }}
                   path: |

.github/workflows/build_macos.yaml

@@ -79,12 +79,13 @@ jobs:
               with:
                   xcode-version: latest-stable
 
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
                   repository: element-hq/element-desktop
                   ref: ${{ inputs.ref }}
+                  persist-credentials: false
 
-            - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+            - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
               with:
                   name: ${{ inputs.prepare-artifact-name }}
 
@@ -130,7 +131,7 @@ jobs:
             - name: "[Signed] Build App"
               if: inputs.sign != ''
               run: |
-                  pnpm build:universal --publish never -m ${{ inputs.targets }}
+                  pnpm build:universal --publish never -m ${TARGETS}
               env:
                   APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
                   APPLE_ID: ${{ secrets.APPLE_ID }}
@@ -140,6 +141,7 @@ jobs:
                   VARIANT_PATH: variant.json
                   # Only set for Nightly builds
                   VERSION: ${{ inputs.version }}
+                  TARGETS: ${{ inputs.targets }}
 
             - name: Check app was signed & notarised successfully
               if: inputs.sign != ''
@@ -152,10 +154,11 @@ jobs:
             - name: "[Unsigned] Build App"
               if: inputs.sign == ''
               run: |
-                  pnpm build:universal --publish never -m ${{ inputs.targets }}
+                  pnpm build:universal --publish never -m ${TARGETS}
               env:
                   CSC_IDENTITY_AUTO_DISCOVERY: false
                   VARIANT_PATH: variant.json
+                  TARGETS: ${{ inputs.targets }}
 
             - name: Generate releases.json
               if: inputs.base-url
@@ -163,7 +166,7 @@ jobs:
                   PKG_JSON_VERSION=$(cat package.json | jq -r .version)
                   LATEST=$(find dist -type f -iname "*-mac.zip" | xargs -0 -n1 -- basename)
                   # Encode spaces in the URL as Squirrel.Mac complains about bad JSON otherwise
-                  URL="${{ inputs.base-url }}/update/macos/${LATEST// /%20}"
+                  URL="${BASE_URL}/update/macos/${LATEST// /%20}"
 
                   jq -n --arg version "${VERSION:-$PKG_JSON_VERSION}" --arg url "$URL" '
                     {
@@ -182,10 +185,11 @@ jobs:
                   ' > dist/releases-legacy.json
               env:
                   VERSION: ${{ inputs.version }}
+                  BASE_URL: ${{ inputs.base-url }}
 
             # We exclude mac-universal as the unpacked app takes forever to upload and zip and dmg already contains it
             - name: Upload Artifacts
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
               with:
                   name: ${{ inputs.artifact-prefix }}macos
                   path: |

.github/workflows/build_prepare.yaml

@@ -54,7 +54,9 @@ jobs:
         outputs:
             nightly-version: ${{ steps.versions.outputs.nightly }}
         steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -84,7 +86,10 @@ jobs:
 
             - name: Fetch Element Web (${{ inputs.version }})
               if: steps.branch-matching.outcome == 'failure' || steps.branch-matching.outcome == 'skipped'
-              run: pnpm run fetch --noverify -d ${{ inputs.config }} ${{ inputs.version }}
+              run: pnpm run fetch --noverify -d ${CONFIG} ${VERSION}
+              env:
+                  CONFIG: ${{ inputs.config }}
+                  VERSION: ${{ inputs.version }}
 
             - name: Copy variant config
               run: cp "$CONFIG_DIR/build.json" variant.json
@@ -131,7 +136,7 @@ jobs:
             - name: "[Release] Fetch release"
               id: release
               if: ${{ !inputs.nightly && inputs.version != 'develop' }}
-              uses: cardinalby/git-get-release-action@cedef2faf69cb7c55b285bad07688d04430b7ada # v1
+              uses: cardinalby/git-get-release-action@cedef2faf69cb7c55b285bad07688d04430b7ada # v1.2.4
               env:
                   GITHUB_TOKEN: ${{ github.token }}
               with:
@@ -159,15 +164,17 @@ jobs:
                   WEB_VERSION=${WEBAPP_VERSION:0:12}
                   JS_VERSION=${WEBAPP_VERSION:16:12}
 
-                  echo "### Nightly build ${{ steps.versions.outputs.nightly }}" >> $GITHUB_STEP_SUMMARY
+                  echo "### Nightly build ${NIGHTLY_VERSION}" >> $GITHUB_STEP_SUMMARY
                   echo "" >> $GITHUB_STEP_SUMMARY
                   echo "| Component   | Version |" >> $GITHUB_STEP_SUMMARY
                   echo "| ----------- | ------- |" >> $GITHUB_STEP_SUMMARY
                   echo "| Bundle Hash | $BUNDLE_HASH |" >> $GITHUB_STEP_SUMMARY
                   echo "| Element Web | [$WEB_VERSION](https://github.com/element-hq/element-web/commit/$WEB_VERSION) |" >> $GITHUB_STEP_SUMMARY
                   echo "| JS SDK      | [$JS_VERSION](https://github.com/matrix-org/matrix-js-sdk/commit/$JS_VERSION) |" >> $GITHUB_STEP_SUMMARY
+              env:
+                  NIGHTLY_VERSION: ${{ steps.versions.outputs.nightly }}
 
-            - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+            - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
               with:
                   name: webapp
                   retention-days: 1

.github/workflows/build_test.yaml

@@ -36,9 +36,10 @@ jobs:
         name: Test ${{ inputs.project }}
         runs-on: ${{ inputs.runs-on }}
         steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
                   repository: ${{ github.repository == 'element-hq/element-web-pro' && 'element-hq/element-desktop' || github.repository }}
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -49,13 +50,15 @@ jobs:
             - name: Install Deps
               run: "pnpm install --frozen-lockfile"
 
-            - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+            - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
               with:
                   name: ${{ inputs.artifact }}
                   path: dist
 
             - name: Prepare for tests
-              run: ${{ inputs.prepare_cmd }}
+              # This is set by the caller of the reusable workflow, they have the ability to run the command they specify
+              # directly without our help so this is fine.
+              run: ${{ inputs.prepare_cmd }} # zizmor: ignore[template-injection]
               if: inputs.prepare_cmd
 
             - name: Expand executable path
@@ -87,7 +90,7 @@ jobs:
 
             - name: Upload blob report
               if: always() && inputs.blob_report
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
               with:
                   name: blob-report-${{ inputs.artifact }}
                   path: blob-report
@@ -95,7 +98,7 @@ jobs:
 
             - name: Upload HTML report
               if: always() && inputs.blob_report == false
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
               with:
                   name: ${{ inputs.artifact }}-test
                   path: playwright-report

.github/workflows/build_windows.yaml

@@ -108,12 +108,13 @@ jobs:
                         }
                       }
 
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
               with:
                   repository: element-hq/element-desktop
                   ref: ${{ inputs.ref }}
+                  persist-credentials: false
 
-            - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
+            - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8
               with:
                   name: ${{ inputs.prepare-artifact-name }}
 
@@ -146,7 +147,9 @@ jobs:
               run: |
                   rustup toolchain install stable --profile minimal --no-self-update
                   rustup default stable
-                  rustup target add ${{ steps.config.outputs.target }}
+                  rustup target add $env:TARGET
+              env:
+                  TARGET: ${{ steps.config.outputs.target }}
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -187,7 +190,9 @@ jobs:
               if: steps.cache.outputs.cache-hit != 'true'
               run: |
                   refreshenv
-                  pnpm build:native --target ${{ steps.config.outputs.target }}
+                  pnpm build:native --target $env:TARGET
+              env:
+                  TARGET: ${{ steps.config.outputs.target }}
 
             - name: Install and configure eSigner CKA
               run: |
@@ -209,7 +214,7 @@ jobs:
 
                   # Configure - default credentials from https://www.ssl.com/guide/esigner-demo-credentials-and-certificates/
                   ${{ env.INSTALL_DIR }}/eSignerCKATool.exe config `
-                      -mode ${{ vars.ESIGNER_MODE || 'sandbox' }} `
+                      -mode "$env:ESIGNER_MODE" `
                       -user "${{ secrets.ESIGNER_USER_NAME || 'esigner_demo' }}" `
                       -pass "${{ secrets.ESIGNER_USER_PASSWORD || 'esignerDemo#1' }}" `
                       -totp "${{ secrets.ESIGNER_USER_TOTP || 'RDXYgV9qju+6/7GnMf1vCbKexXVJmUVr+86Wq/8aIGg=' }}" `
@@ -228,12 +233,14 @@ jobs:
                   echo "ED_SIGNTOOL_THUMBPRINT=$Thumbprint" >> $env:GITHUB_ENV
                   echo "ED_SIGNTOOL_SUBJECT_NAME=$SubjectName" >> $env:GITHUB_ENV
               env:
+                  ESIGNER_MODE: ${{ vars.ESIGNER_MODE || 'sandbox' }}
                   ESIGNER_URL: https://github.com/SSLcom/eSignerCKA/releases/download/v1.0.6/SSL.COM-eSigner-CKA_1.0.6.zip
                   INSTALL_DIR: C:\Users\runneradmin\eSignerCKA
                   MASTER_KEY_FILE: C:\Users\runneradmin\eSignerCKA\master.key
 
             - name: Build App
-              run: pnpm build --publish never ${{ steps.config.outputs.build-args }} -w ${{ inputs.targets }}
+              run: pnpm build --publish never $BUILD_ARGS -w $TARGETS
+              shell: bash
               env:
                   VARIANT_PATH: variant.json
                   # Only set for Nightly builds
@@ -243,6 +250,8 @@ jobs:
                   # We just give the installer a static name, so you'll just see this in the 'about' dialog.
                   # Turns out if you use 0.0.0 here it makes Squirrel windows crash, so we use 0.0.1.
                   VERSION: ${{ inputs.version && format('0.0.1-nightly.{0}', inputs.version) || '' }}
+                  BUILD_ARGS: ${{ steps.config.outputs.build-args }}
+                  TARGETS: ${{ inputs.targets }}
 
             - name: Trust eSigner sandbox cert
               if: inputs.sign == ''
@@ -259,7 +268,7 @@ jobs:
                   | ForEach-Object -Process {. $env:SIGNTOOL_PATH verify /pa $_.FullName; if(!$?) { throw }}
 
             - name: Upload Artifacts
-              uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+              uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
               with:
                   name: ${{ inputs.artifact-prefix }}win-${{ inputs.arch }}
                   path: |

.github/workflows/dockerbuild.yaml

@@ -19,7 +19,9 @@ jobs:
             contents: read
             packages: write
         steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - name: Set up QEMU
               uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3
@@ -30,7 +32,7 @@ jobs:
                   install: true
 
             - name: Build test image
-              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
               with:
                   file: dockerbuild/Dockerfile
                   push: false
@@ -61,7 +63,7 @@ jobs:
 
             - name: Build and push Docker image
               if: github.event_name != 'pull_request'
-              uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+              uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
               with:
                   file: dockerbuild/Dockerfile
                   push: true

.github/workflows/localazy_download.yaml

@@ -7,7 +7,7 @@ permissions:
     pull-requests: write # needed to auto-approve PRs
 jobs:
     download:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_download.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
         with:
             packageManager: pnpm
         secrets:

.github/workflows/localazy_upload.yaml

@@ -7,6 +7,6 @@ on:
 permissions: {} # No permissions needed
 jobs:
     upload:
-        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@main
+        uses: matrix-org/matrix-web-i18n/.github/workflows/localazy_upload.yaml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
         secrets:
             LOCALAZY_WRITE_KEY: ${{ secrets.LOCALAZY_WRITE_KEY }}

.github/workflows/pull_request.yaml

@@ -1,11 +1,13 @@
 name: Pull Request
 on:
-    pull_request_target:
+    # Privilege escalation necessary access members of the review teams
+    # 🚨 We must not execute any checked out code here, and be careful around use of user-controlled inputs.
+    pull_request_target: # zizmor: ignore[dangerous-triggers]
         types: [opened, edited, labeled, unlabeled, synchronize]
 permissions: {}
 jobs:
     action:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/pull_request.yaml@develop # zizmor: ignore[unpinned-uses]
         permissions:
             pull-requests: write
         secrets:

.github/workflows/release-drafter.yml

@@ -7,7 +7,7 @@ concurrency: ${{ github.workflow }}
 permissions: {}
 jobs:
     draft:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-drafter-workflow.yml@develop # zizmor: ignore[unpinned-uses]
         permissions:
             contents: write
         with:

.github/workflows/release-gitflow.yml

@@ -7,6 +7,6 @@ concurrency: ${{ github.repository }}-${{ github.workflow }}
 permissions: {} # Uses ELEMENT_BOT_TOKEN
 jobs:
     merge:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-gitflow.yml@develop # zizmor: ignore[unpinned-uses]
         secrets:
             ELEMENT_BOT_TOKEN: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/release.yml

@@ -14,7 +14,7 @@ concurrency: ${{ github.workflow }}
 permissions: {}
 jobs:
     release:
-        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop
+        uses: matrix-org/matrix-js-sdk/.github/workflows/release-make.yml@develop # zizmor: ignore[unpinned-uses]
         permissions:
             contents: write
             issues: write

.github/workflows/static_analysis.yaml

@@ -9,7 +9,9 @@ jobs:
         name: "Typescript Syntax Check"
         runs-on: ubuntu-24.04
         steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -26,7 +28,7 @@ jobs:
 
     i18n_lint:
         name: "i18n Check"
-        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@3673fd3abbf8dfae1de849c6cd3e69e24ed7a766
+        uses: matrix-org/matrix-web-i18n/.github/workflows/i18n_check.yml@6eda3835118f3bc3fb658a1a3c20b7da9d16ae42
         permissions:
             pull-requests: read
         with:
@@ -37,7 +39,9 @@ jobs:
         name: "ESLint"
         runs-on: ubuntu-24.04
         steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -55,8 +59,12 @@ jobs:
     workflow_lint:
         name: "Workflow Lint"
         runs-on: ubuntu-24.04
+        permissions:
+            security-events: write
         steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6
@@ -71,11 +79,16 @@ jobs:
             - name: Run Linter
               run: "pnpm lint:workflows"
 
+            - name: Run zizmor
+              uses: zizmorcore/zizmor-action@0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d # v0.5.0
+
     analyse_dead_code:
         name: "Analyse Dead Code"
         runs-on: ubuntu-24.04
         steps:
-            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+              with:
+                  persist-credentials: false
 
             - uses: pnpm/action-setup@41ff72655975bd51cab0327fa583b6e92b6d3061 # v4
             - uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6

.github/workflows/sync-labels.yml

@@ -11,7 +11,7 @@ on:
 permissions: {} # Uses ELEMENT_BOT_TOKEN
 jobs:
     sync-labels:
-        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@develop
+        uses: element-hq/element-meta/.github/workflows/sync-labels.yml@dac99c67f08f8f2a079e885ffb682a2f39cd3960
         with:
             LABELS: |
                 element-hq/element-web

.github/workflows/triage-incoming.yml

@@ -10,7 +10,7 @@ jobs:
     automate-project-columns-next:
         runs-on: ubuntu-24.04
         steps:
-            - uses: actions/add-to-project@main
+            - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
               with:
                   project-url: https://github.com/orgs/element-hq/projects/120
                   github-token: ${{ secrets.ELEMENT_BOT_TOKEN }}

.github/workflows/triage-labelled.yml

@@ -8,5 +8,5 @@ permissions: {} # Uses ELEMENT_BOT_TOKEN
 
 jobs:
     call-triage-labelled:
-        uses: element-hq/element-web/.github/workflows/triage-labelled.yml@develop
+        uses: element-hq/element-web/.github/workflows/triage-labelled.yml@develop # zizmor: ignore[unpinned-uses]
-        secrets: inherit
+        secrets: inherit # zizmor: ignore[secrets-inherit]

.github/workflows/triage-stale.yml

@@ -12,7 +12,7 @@ jobs:
             issues: write
             pull-requests: write
         steps:
-            - uses: actions/stale@997185467fa4f803885201cee163a9f38240193d # v10
+            - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10
               with:
                   operations-per-run: 250
                   days-before-issue-stale: -1

.gitignore

@@ -19,3 +19,4 @@ yarn-error.log
 /scripts/hak/**/*.js
 .DS_Store
 /playwright-report
+.pnpm-store

.node-version

@@ -1 +1 @@
-24.13.0
+24.14.0

dockerbuild/Dockerfile

@@ -1,6 +1,6 @@
 # Docker image to facilitate building Element Desktop's native bits using a glibc version (2.31)
 # with broader compatibility, down to Debian bullseye & Ubuntu focal.
-FROM rust:bullseye@sha256:3ebcc2d6d71fb93a2967e35723902c51dd87dbb36f66f795a58d7921553fbcd4
+FROM rust:bullseye@sha256:fae8ebcb8eda28d37df2b965c87c15a572dac2b6d3893a72d6dea99d700d1786
 
 ENV DEBIAN_FRONTEND=noninteractive
 

package.json

@@ -76,7 +76,7 @@
         "@babel/preset-env": "^7.18.10",
         "@babel/preset-typescript": "^7.18.6",
         "@electron/asar": "4.0.1",
-        "@playwright/test": "1.58.1",
+        "@playwright/test": "1.58.2",
         "@stylistic/eslint-plugin": "^5.0.0",
         "@types/auto-launch": "^5.0.1",
         "@types/counterpart": "^0.18.1",
@@ -85,12 +85,12 @@
         "@types/pacote": "^11.1.1",
         "@typescript-eslint/eslint-plugin": "^8.0.0",
         "@typescript-eslint/parser": "^8.0.0",
-        "app-builder-lib": "26.6.0",
+        "app-builder-lib": "26.7.0",
         "chokidar": "^5.0.0",
         "detect-libc": "^2.0.0",
-        "electron": "40.1.0",
+        "electron": "40.6.1",
-        "electron-builder": "26.6.0",
+        "electron-builder": "26.7.0",
-        "electron-builder-squirrel-windows": "26.6.0",
+        "electron-builder-squirrel-windows": "26.7.0",
         "electron-devtools-installer": "^4.0.0",
         "eslint": "^8.26.0",
         "eslint-config-google": "^0.14.0",
@@ -108,7 +108,7 @@
         "pacote": "^21.0.0",
         "prettier": "^3.0.0",
         "rimraf": "^6.0.0",
-        "tar": "^7.0.0",
+        "tar": "^7.5.8",
         "tsx": "^4.19.2",
         "typescript": "5.9.3"
     },
@@ -116,7 +116,7 @@
         "matrix-seshat": "^4.0.1"
     },
     "resolutions": {
-        "atomically": "2.1.0",
+        "atomically": "2.1.1",
         "@types/node": "18.19.130",
         "config-file-ts": "0.2.8-rc1",
         "node-abi": "4.26.0",

playwright/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/playwright:v1.58.1-jammy@sha256:1b52a0833ae13c3bb16f728eec5f9216db29f3cd5eec21a9cbd33e7623723c0e
+FROM mcr.microsoft.com/playwright:v1.58.2-jammy@sha256:4698a73749c5848d3f5fcd42a2174d172fcad2b2283e087843b115424303a565
 
 WORKDIR /work/element-desktop