improve

.github/dependabot.yml

@@ -4,3 +4,9 @@ updates:
   directory: "/"
   schedule:
     interval: "weekly"
+  groups:
+    action-deps:
+      patterns:
+        - "*"
+  cooldown:
+    default-days: 7

.github/workflows/ci.yml

@@ -1,21 +1,42 @@
 on:
   pull_request:
 
+permissions: {}
+
 jobs:
+  check:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v6
-    - uses: asdf-vm/actions/install@v4
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
+    - uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4
       with:
         tool_versions: |
-          action-validator 0.5.1
+          action-validator 0.9.0
     - run: action-validator --verbose ./action.yml
 
   test:
     needs:
     - lint
+    - check
     runs-on: ubuntu-latest
+    permissions:
+      contents:  read
     env:
       MC_USER: user
       MC_PASS: minio123
@@ -28,7 +49,9 @@ jobs:
         ports:
         - 9001:9000
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - uses: ./
     - run: mc alias set minio http://127.0.0.1:9001 $MC_USER $MC_PASS
     - run: mc mb minio/test
@@ -38,7 +61,10 @@ jobs:
   test-inputs:
     needs:
     - lint
+    - check
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     services:
       minio:
         image: fclairamb/minio-github-actions
@@ -48,7 +74,9 @@ jobs:
         ports:
         - 9002:9000
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      with:
+        persist-credentials: false
     - uses: ./
       with:
         alias-name: example

.github/zizmor.yml

@@ -0,0 +1,5 @@
+rules:
+  github-env:
+    disable: true
+  unpinned-images:
+    disable: true

action.yml

@@ -7,7 +7,7 @@ inputs:
   dl-url:
     description: 'The url to download mc from'
     required: true
-    default: 'https://dl.minio.io/client/mc/release/linux-amd64/mc'
+    default: 'https://dl.min.io/client/mc/release/linux-amd64/mc'
   alias-name:
     description: 'The name of the alias'
     required: false
@@ -33,10 +33,13 @@ runs:
     run: |
       curl \
         -H 'Cache-Control: no-cache' \
-        "${{ inputs.dl-url }}" \
+        --location \
+        "${DL_URL}" \
         -o ${{ github.action_path }}/bin/mc
-      echo "Installed mc from ${{ inputs.dl-url }}" >> $GITHUB_STEP_SUMMARY
+      echo "Installed mc from ${DL_URL}" >> $GITHUB_STEP_SUMMARY
     shell: bash
+    env:
+      DL_URL: ${{ inputs.dl-url }}
   - name: make executable
     run: chmod +x ${{ github.action_path }}/bin/mc
     shell: bash
@@ -50,8 +53,13 @@ runs:
     run: |
       set -euo pipefail
       mc alias set \
-      ${{ inputs.alias-name }} \
-      ${{ inputs.alias-url }} \
-      ${{ inputs.alias-access-key }} \
-      ${{ inputs.alias-secret-key }}
-      echo "Configured [${{ inputs.alias-name}}](${{ inputs.alias-url }})" >> $GITHUB_STEP_SUMMARY
+        "${ALIAS_NAME}" \
+        "${ALIAS_URL}" \
+        "${ALIAS_ACCESS_KEY}" \
+        "${ALIAS_SECRET_KEY}"
+      echo "Configured [${ALIAS_NAME}](${ALIAS_URL})" >> $GITHUB_STEP_SUMMARY
+    env:
+      ALIAS_NAME: ${{ inputs.alias-name}}
+      ALIAS_URL: ${{ inputs.alias-url }}
+      ALIAS_ACCESS_KEY: ${{ inputs.alias-access-key }}
+      ALIAS_SECRET_KEY: ${{ inputs.alias-secret-key }}