ci: enable zizmor security checks

[fengmk2]

CI has no security check for GitHub Actions. Add zizmor for pushes to master, pull requests, and merge queues. Findings appear as annotations and fail the check.

Pin the reusable Node.js workflow to a commit hash. Set deployment permissions to {} because the webhook request does not need a GitHub token.

Summary by CodeRabbit

• Chores
  • Deployment workflows now use restricted permissions.
  • Automated security checks run as part of the continuous integration workflow, with results surfaced as annotations.
  • The reusable Node.js workflow now uses a fixed version, helping ensure consistent runs across builds.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
cnpmweb	Ready	Preview	Oct 16, 2026 3:26pm UTC

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

An organization owner can choose the repository organization as the billing source for reviews requested by members with a paid Copilot license. Learn about Copilot code review billing.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: af2cc7cc-3157-44cf-a218-cf31d2d03ac0

📥 Commits

Reviewing files that changed from the base of the PR and between 0786789 and cffb023.

📒 Files selected for processing: 2

• .github/workflows/deploy.yml
• .github/workflows/nodejs.yml

+-----------------------------------------------------------------------------+
| Butterfly effect: one bug in your code can cause a hurricane in production. |
+-----------------------------------------------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying cnpmweb with    Cloudflare Pages

Latest commit:	cffb023
Status:	✅  Deploy successful!
Preview URL:	https://8cc9ef0c.cnpmweb.pages.dev
Branch Preview URL:	https://ci-enable-zizmor.cnpmweb.pages.dev

View logs