From 37d619d05a96e467771dcfd25220e860ce72f9e2 Mon Sep 17 00:00:00 2001
From: Derek Cofausper <256792747+decofe@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:16:18 +0000
Subject: [PATCH 1/4] chore: add GitHub Actions scan workflow

---
 .github/workflows/scan-github-actions.yml | 24 +++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 .github/workflows/scan-github-actions.yml

diff --git a/.github/workflows/scan-github-actions.yml b/.github/workflows/scan-github-actions.yml
new file mode 100644
index 0000000..1d5a483
--- /dev/null
+++ b/.github/workflows/scan-github-actions.yml
@@ -0,0 +1,24 @@
+name: Scan GitHub Actions
+
+on:
+  pull_request:
+    paths:
+      - ".github/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/**"
+  schedule:
+    - cron: "17 9 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  scan:
+    if: ${{ github.event_name != 'schedule' || github.repository == 'tempoxyz/wallet-cli' }}
+    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@512158c4e90e42eef8aa7fc3fc3186a79b5b4648 # main
+    permissions:
+      actions: read
+      contents: read

From 75023512884a0ea18e7dfdcf1d1e040575335abc Mon Sep 17 00:00:00 2001
From: Derek Cofausper <256792747+decofe@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:19:44 +0000
Subject: [PATCH 2/4] fix(ci): pin friction logger actions

---
 .github/workflows/friction-log.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/friction-log.yml b/.github/workflows/friction-log.yml
index af81055..10e868a 100644
--- a/.github/workflows/friction-log.yml
+++ b/.github/workflows/friction-log.yml
@@ -27,12 +27,12 @@ jobs:
 
     steps:
       - name: Clone repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ github.sha }}
 
       - name: Report and reconcile frictions
-        uses: wevm/frog/action@v1
+        uses: wevm/frog/action@a9f4314e3317975c5a8a6f0fc71332d7110f72b6 # v1
         with:
           issue-author: github-actions[bot]

From 236ea5202ee05229f56e2510fc54cebec1596c3a Mon Sep 17 00:00:00 2001
From: Derek Cofausper <256792747+decofe@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:19:45 +0000
Subject: [PATCH 3/4] fix(ci): quote package smoke test path

---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 361597b..93adb86 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -126,7 +126,7 @@ jobs:
 
       - name: Smoke test host binary
         if: matrix.build.pkg_target == 'node22-linux-x64' || matrix.build.pkg_target == 'node22-linux-arm64' || matrix.build.pkg_target == 'node22-macos-arm64'
-        run: ./artifacts/${PACKAGE}-${{ matrix.build.suffix }} --version
+        run: ./artifacts/"${PACKAGE}"-${{ matrix.build.suffix }} --version
 
       - name: Generate sha256
         shell: bash

From 1b26aa8b0876c115a5c54ec039fbda2da0b57108 Mon Sep 17 00:00:00 2001
From: Derek Cofausper <256792747+decofe@users.noreply.github.com>
Date: Mon, 3 Aug 2026 08:20:54 +0000
Subject: [PATCH 4/4] fix(ci): document changelog CLI install

---
 .github/workflows/changelog-generate.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/changelog-generate.yml b/.github/workflows/changelog-generate.yml
index 56a24bd..f7d5da5 100644
--- a/.github/workflows/changelog-generate.yml
+++ b/.github/workflows/changelog-generate.yml
@@ -83,6 +83,7 @@ jobs:
 
       - name: Install changelog dependencies
         if: steps.source.outputs.same_repo == 'true' && steps.existing.outputs.found == 'false'
+        # zizmor: ignore[adhoc-packages] -- workflow-only CLI
         run: |
           corepack enable
           corepack prepare pnpm@11.0.8 --activate