From 152b475464e943c31794ac7909c5d048a4f4783c Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 28 May 2026 13:25:44 -0400
Subject: [PATCH 1/6] add zizmor and fix issues

---
 .github/workflows/pint-link.yml | 13 +++++++++++--
 .github/workflows/zizmor.yml    | 23 +++++++++++++++++++++++
 2 files changed, 34 insertions(+), 2 deletions(-)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/pint-link.yml b/.github/workflows/pint-link.yml
index 89b9233..732a902 100644
--- a/.github/workflows/pint-link.yml
+++ b/.github/workflows/pint-link.yml
@@ -5,16 +5,25 @@ on:
     paths:
       - '**.php'
 
+permissions: { }
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   lint-php-code-styling:
+    name: Lint PHP code style issues
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          persist-credentials: false
 
       - name: Check PHP code style issues
-        uses: aglipanci/laravel-pint-action@v2
+        uses: aglipanci/laravel-pint-action@36de00d5f5a8a4e12d443e01671daa12a18f4c79 # v2.6
         with:
           testMode: true
           verboseMode: true
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..1278d67
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,23 @@
+name: GitHub Actions Security Analysis
+
+on:
+  push:
+    branches:
+      - master
+      - '*.x'
+    paths:
+      - '.github/**.yml'
+  pull_request:
+    paths:
+      - '.github/**.yml'
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    uses: statamic/.github/.github/workflows/zizmor.yml@7e941c239074d66da6cad3322bec3b1005c80cf7
+    permissions: {}

From 73a198f845fc98f2be6fb68f25579035f11b40a3 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 28 May 2026 13:26:03 -0400
Subject: [PATCH 2/6] fix tpyo

---
 .github/workflows/{pint-link.yml => pint-lint.yml} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename .github/workflows/{pint-link.yml => pint-lint.yml} (100%)

diff --git a/.github/workflows/pint-link.yml b/.github/workflows/pint-lint.yml
similarity index 100%
rename from .github/workflows/pint-link.yml
rename to .github/workflows/pint-lint.yml

From 35d0e4edb639a3f6e6118cdae00835823689e815 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 28 May 2026 13:41:02 -0400
Subject: [PATCH 3/6] fix tag mismatch

---
 .github/workflows/pint-lint.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/pint-lint.yml b/.github/workflows/pint-lint.yml
index 732a902..32598f2 100644
--- a/.github/workflows/pint-lint.yml
+++ b/.github/workflows/pint-lint.yml
@@ -23,7 +23,7 @@ jobs:
           persist-credentials: false
 
       - name: Check PHP code style issues
-        uses: aglipanci/laravel-pint-action@36de00d5f5a8a4e12d443e01671daa12a18f4c79 # v2.6
+        uses: aglipanci/laravel-pint-action@36de00d5f5a8a4e12d443e01671daa12a18f4c79 # 2.6
         with:
           testMode: true
           verboseMode: true

From f32d41bf89afe227f62471f30a0facebf675cb10 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 28 May 2026 13:41:05 -0400
Subject: [PATCH 4/6] redundant

---
 .github/workflows/zizmor.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 1278d67..a27891d 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -20,4 +20,3 @@ concurrency:
 jobs:
   zizmor:
     uses: statamic/.github/.github/workflows/zizmor.yml@7e941c239074d66da6cad3322bec3b1005c80cf7
-    permissions: {}

From d728b65a664f7fe9348dcb0ea288dbb4d19b8270 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 28 May 2026 13:42:03 -0400
Subject: [PATCH 5/6] editing a php file to test pint still runs

---
 src/Artisan.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Artisan.php b/src/Artisan.php
index 46f12c0..4bad2bc 100644
--- a/src/Artisan.php
+++ b/src/Artisan.php
@@ -8,7 +8,7 @@
 
 class Artisan
 {
-    protected $output;
+    protected $output; // test
     protected $cwd;
 
     /**

From fc5268a5d5c4a66aed2afc6ff84f9b6670619f86 Mon Sep 17 00:00:00 2001
From: Jason Varga <jason@pixelfear.com>
Date: Thu, 28 May 2026 13:42:50 -0400
Subject: [PATCH 6/6] cool beans

---
 src/Artisan.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Artisan.php b/src/Artisan.php
index 4bad2bc..46f12c0 100644
--- a/src/Artisan.php
+++ b/src/Artisan.php
@@ -8,7 +8,7 @@
 
 class Artisan
 {
-    protected $output; // test
+    protected $output;
     protected $cwd;
 
     /**