marcalexiei · Oct 10, 2026 · Oct 10, 2026 · Oct 10, 2026
diff --git a/.github/jactionlint.yaml b/.github/jactionlint.yaml
@@ -0,0 +1 @@
+profile: pedantic
diff --git a/.github/workflows/changesets-pr-status.yml b/.github/workflows/changesets-pr-status.yml
@@ -15,7 +15,8 @@ jobs:
     name: Generate PR status
     # skip the release PR opened by `changesets/action`: it never has changesets
     if: ${{ !startsWith(github.head_ref, 'changeset-release/') }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
 
     permissions:
       contents: read # to check out repo (actions/checkout)
@@ -35,7 +36,8 @@ jobs:
   pr-comment:
     name: Comment on PR
     needs: pr-status
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
 
     permissions:
       pull-requests: write # to create and update comments on PRs (changesets/action/pr-comment)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -15,6 +15,10 @@ concurrency:
 
 permissions: {}
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   build-and-test:
     name: Build and test ${{ matrix.node }} on ${{ matrix.os }}
@@ -23,8 +27,9 @@ jobs:
       fail-fast: false
       matrix:
         node: [24, 26]
-        os: [ubuntu-latest, macos-latest]
+        os: [ubuntu-24.04, macos-15]
     runs-on: ${{ matrix.os }}
+    timeout-minutes: 10
 
     permissions:
       contents: read
@@ -49,7 +54,8 @@ jobs:
   code-checks:
     name: Code checks
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
 
     permissions:
       contents: read
@@ -92,7 +98,8 @@ jobs:
   docs:
     name: Docs site
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
 
     permissions:
       contents: read
@@ -136,7 +143,8 @@ jobs:
   image:
     name: Server image
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
 
     permissions:
       contents: read
@@ -175,8 +183,9 @@ jobs:
 
   ci-ok:
     name: CI OK
-    runs-on: ubuntu-latest
-    if: always()
+    runs-on: ubuntu-24.04
+    timeout-minutes: 1
+    if: ${{ always() }}
     needs:
       - build-and-test
       - code-checks

diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
@@ -17,11 +17,16 @@ concurrency:
 
 permissions: {}
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   deploy:
     name: Build and deploy to Pages
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
 
     environment:
       name: docs

diff --git a/.github/workflows/github-actions-audit.yml b/.github/workflows/github-actions-audit.yml
@@ -19,10 +19,9 @@ concurrency:
 jobs:
   zizmor:
     name: zizmor
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     permissions:
-      security-events: write # required to upload SARIF results to GitHub Code Scanning
       contents: read # required to check out the repository
       actions: read # required by zizmor to read workflow runs
 
@@ -34,3 +33,23 @@ jobs:
 
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: false
+
+  jactionlint:
+    name: jactionlint
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
+    permissions:
+      contents: read # required to check out the repository
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run jactionlint
+        uses: jdx/jactionlint@a0bb9f012b6b5760c17c9ccd040001d08002a10e # v2.1.0
+        with:
+          online: false # keeps the token out of the downloaded binary's environment
diff --git a/.github/workflows/publish-image.yml b/.github/workflows/publish-image.yml
@@ -21,11 +21,16 @@ concurrency:
 
 permissions: {}
 
+defaults:
+  run:
+    shell: bash
+
 jobs:
   publish:
     name: Build and push to GHCR
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
 
     permissions:
       contents: read # to check out the repository
@@ -50,6 +55,8 @@ jobs:
 
       - name: Set up Buildx
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        with:
+          cache-binary: false # a poisoned cache entry must not reach the published image
 
       - name: Log in to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -19,6 +19,10 @@ concurrency:
 permissions: {}
 
 # Skips the pre-commit hook — see ../CONTRIBUTING.md, "Workflows That Commit".
+defaults:
+  run:
+    shell: bash
+
 env:
   LEFTHOOK: 0
 
@@ -29,7 +33,8 @@ jobs:
     environment: release-npm
 
     if: ${{ github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.head_repository.full_name == github.repository }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 10
 
     permissions:
       contents: write # required to push release commits and tags
@@ -86,8 +91,8 @@ jobs:
     if: ${{ contains(fromJSON(needs.release.outputs.publishedPackages).*.name, '@stats-forge/github-stats-server') }}
     uses: $/.github/workflows/publish-image.yml
     permissions:
-      contents: read
-      packages: write
+      contents: read # to check out the repository
+      packages: write # to push the image to GHCR
     with:
       ref: ${{ github.event.workflow_run.head_sha }}
 
@@ -96,7 +101,8 @@ jobs:
   annotate:
     name: Annotate
     needs: [release, image]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
 
     permissions:
       contents: write # required to edit the release body
@@ -148,9 +154,9 @@ jobs:
     if: ${{ needs.release.outputs.published == 'true' }}
     uses: $/.github/workflows/deploy-docs.yml
     permissions:
-      contents: read
-      pages: write
-      id-token: write
+      contents: read # to check out repo (actions/checkout)
+      pages: write # to publish to GitHub Pages (actions/deploy-pages)
+      id-token: write # to verify the deployment originates from this workflow
     with:
       ref: ${{ github.event.workflow_run.head_sha }}
 
@@ -160,7 +166,8 @@ jobs:
     name: Comment
     needs: release
     if: ${{ needs.release.outputs.published == 'true' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
 
     environment: release-npm # where the release helper's credentials live
 
@@ -192,7 +199,8 @@ jobs:
 
   on-ci-fail:
     name: 'Failure'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 1
     if: ${{ github.event.workflow_run.conclusion == 'failure' }}
     steps:
       - run: echo "CI failed. Release will not run"
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
@@ -42,9 +42,9 @@ permissions: {}
 
 jobs:
   renovate:
-    if: github.repository == 'stats-forge/github-stats-forge'
+    if: ${{ github.repository == 'stats-forge/github-stats-forge' }}
     name: Renovate
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
 
     timeout-minutes: 30
 

diff --git a/.github/workflows/update-emoji-map.yml b/.github/workflows/update-emoji-map.yml
@@ -17,14 +17,19 @@ on:
 permissions: {}
 
 # Skips the pre-commit hook — see ../CONTRIBUTING.md, "Workflows That Commit".
+defaults:
+  run:
+    shell: bash
+
 env:
   LEFTHOOK: 0
 
 jobs:
   update-emoji-map:
-    if: github.repository == 'stats-forge/github-stats-forge'
+    if: ${{ github.repository == 'stats-forge/github-stats-forge' }}
     name: Generate Emoji Map
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
 
     environment: update-meta-files # where HELPER_APP_ID and HELPER_PRIVATE_KEY live
 
@@ -64,6 +69,8 @@ jobs:
 
           Regenerated from the [GitHub shortcode preset in emojibase](https://github.com/milesj/emojibase/blob/master/packages/data/en/shortcodes/github.raw.json).'
 
+      # The action also commits and pushes the branch, not only opens the PR.
+      # jactionlint ignore=superfluous-actions
       - name: Create Pull Request if the upstream shortcodes changed
         id: create_pr
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1

diff --git a/.github/workflows/update-language-colors.yml b/.github/workflows/update-language-colors.yml
@@ -16,14 +16,19 @@ on:
 permissions: {}
 
 # Skips the pre-commit hook — see ../CONTRIBUTING.md, "Workflows That Commit".
+defaults:
+  run:
+    shell: bash
+
 env:
   LEFTHOOK: 0
 
 jobs:
   update-languages:
-    if: github.repository == 'stats-forge/github-stats-forge'
+    if: ${{ github.repository == 'stats-forge/github-stats-forge' }}
     name: Generate Language Colors
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 5
 
     environment: update-meta-files # where HELPER_APP_ID and HELPER_PRIVATE_KEY live
 
@@ -63,6 +68,8 @@ jobs:
 
           Regenerated from the [upstream linguist languages file](https://github.com/github/linguist/blob/master/lib/linguist/languages.yml).'
 
+      # The action also commits and pushes the branch, not only opens the PR.
+      # jactionlint ignore=superfluous-actions
       - name: Create Pull Request if upstream language file is changed
         id: create_pr
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1