From c311cafac4a99fd398adcfdf235347714f20d2c9 Mon Sep 17 00:00:00 2001
From: Fokko Driesprong <fokko@apache.org>
Date: Mon, 31 Aug 2026 16:51:16 +0200
Subject: [PATCH 1/2] GH-3758: Add Zizmor to the CI

---
 .github/workflows/ci-hadoop3.yml         |  8 +++--
 .github/workflows/ci-release-scripts.yml |  2 ++
 .github/workflows/stale-prs.yml          |  2 +-
 .github/workflows/vector-plugins.yml     |  8 +++--
 .github/workflows/zizmor.yml             | 46 ++++++++++++++++++++++++
 5 files changed, 61 insertions(+), 5 deletions(-)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/ci-hadoop3.yml b/.github/workflows/ci-hadoop3.yml
index 15c341336e..a2ba244032 100644
--- a/.github/workflows/ci-hadoop3.yml
+++ b/.github/workflows/ci-hadoop3.yml
@@ -28,6 +28,8 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -35,9 +37,11 @@ jobs:
     name: Build Parquet with JDK ${{ matrix.java.setup }}
 
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up JDK ${{ matrix.java.setup }}
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: ${{ matrix.java.setup }}
diff --git a/.github/workflows/ci-release-scripts.yml b/.github/workflows/ci-release-scripts.yml
index bfd5cd624d..3be2909d94 100644
--- a/.github/workflows/ci-release-scripts.yml
+++ b/.github/workflows/ci-release-scripts.yml
@@ -33,6 +33,8 @@ jobs:
   bats:
     name: Release Script Unit Tests
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/stale-prs.yml b/.github/workflows/stale-prs.yml
index ddb9a426e0..54c2bd7efb 100644
--- a/.github/workflows/stale-prs.yml
+++ b/.github/workflows/stale-prs.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - name: Mark and close stale pull requests
-        uses: actions/stale@v11
+        uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           # Don't touch issues.
diff --git a/.github/workflows/vector-plugins.yml b/.github/workflows/vector-plugins.yml
index 05a649713d..9722027a80 100644
--- a/.github/workflows/vector-plugins.yml
+++ b/.github/workflows/vector-plugins.yml
@@ -28,6 +28,8 @@ jobs:
   build:
 
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -36,9 +38,11 @@ jobs:
     name: Build Parquet with JDK ${{ matrix.java }} and ${{ matrix.codes }}
 
     steps:
-      - uses: actions/checkout@master
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v5.7.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           distribution: temurin
           java-version: ${{ matrix.java }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000000..ed17df02eb
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,46 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches:
+      - master
+      - parquet-*
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          advanced-security: false
+          min-severity: medium
+          min-confidence: medium

From e218cbe89a0b6c4eda18267e8b27e2976144e279 Mon Sep 17 00:00:00 2001
From: Fokko Driesprong <fokko@apache.org>
Date: Mon, 31 Aug 2026 17:47:15 +0200
Subject: [PATCH 2/2] Also include dependabot

---
 .github/dependabot.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index dee7d3472b..09b54e6037 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -24,9 +24,13 @@ updates:
     schedule:
       interval: "weekly"
       day: "sunday"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "maven"
     directory: "/"
     schedule:
       interval: "weekly"
       day: "sunday"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 50