From b2e6cbdc1fcb91c5750162711df760d563ad3d8c Mon Sep 17 00:00:00 2001
From: Rob Ede <robjtede@icloud.com>
Date: Wed, 5 Aug 2026 19:34:34 +0100
Subject: [PATCH 1/2] ci: add zizmor GitHub Actions security lint

---
 .github/workflows/lint.yml | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 5936025..2a96c94 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -71,3 +71,22 @@ jobs:
         env:
           RUSTDOCFLAGS: -D warnings
         run: cargo doc --workspace --no-deps --all-features
+
+  zizmor:
+    name: GitHub Actions Security
+    runs-on: ubuntu-latest
+
+    permissions:
+      actions: read
+      contents: read
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Check GitHub Actions security
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          advanced-security: false
+          annotations: true

From f53cddd014560ce75c57ef84a5ba443ac27d9d37 Mon Sep 17 00:00:00 2001
From: Rob Ede <robjtede@icloud.com>
Date: Thu, 6 Aug 2026 11:41:43 +0100
Subject: [PATCH 2/2] chore: remove Dependabot reviewer workflow

---
 .github/workflows/dependabot-reviewer.yml | 39 -----------------------
 1 file changed, 39 deletions(-)
 delete mode 100644 .github/workflows/dependabot-reviewer.yml

diff --git a/.github/workflows/dependabot-reviewer.yml b/.github/workflows/dependabot-reviewer.yml
deleted file mode 100644
index 1a88b92..0000000
--- a/.github/workflows/dependabot-reviewer.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: Dependabot Reviewer
-
-on: pull_request_target
-
-permissions:
-  pull-requests: write
-  contents: write
-
-jobs:
-  review-dependabot-pr:
-    name: Approve PR
-    runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
-    env:
-      PR_URL: ${{ github.event.pull_request.html_url }}
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-    steps:
-      - name: Fetch Dependabot metadata
-        id: dependabot-metadata
-        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
-
-      - name: Enable auto-merge for Dependabot PRs
-        run: gh pr merge --auto --squash "$PR_URL"
-
-      - name: Approve patch and minor updates
-        if: ${{ steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch'|| steps.dependabot-metadata.outputs.update-type == 'version-update:semver-minor'}}
-        run: |
-          gh pr review "$PR_URL" --approve --body "I'm **approving** this pull request because **it only includes patch or minor updates**."
-
-      - name: Approve major updates of dev dependencies
-        if: ${{ steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major' && steps.dependabot-metadata.outputs.dependency-type == 'direct:development'}}
-        run: |
-          gh pr review "$PR_URL" --approve --body "I'm **approving** this pull request because **it only includes major updates of dev dependencies**."
-
-      - name: Comment on major updates of normal dependencies
-        if: ${{ steps.dependabot-metadata.outputs.update-type == 'version-update:semver-major' && steps.dependabot-metadata.outputs.dependency-type == 'direct:production'}}
-        run: |
-          gh pr comment "$PR_URL" --body "I'm **not approving** this PR because **it includes major updates of normal dependencies**."
-          gh pr edit "$PR_URL" --add-label "requires-manual-qa"