fix: harden GitHub Actions workflows (zizmor) (#12)

- Upgrade actions/checkout to v6.0.2 and add persist-credentials: false
- Add workflow-level permissions: {} to release.yml and contents: read to test.yml
- Replace secrets: inherit with explicit secret passing (SOCKET_API_KEY)
- Disable caching in release workflow setup-bun to prevent cache poisoning
- Declare SOCKET_API_KEY as optional workflow_call secret in test.yml
- Disable secrets-outside-env rule via .github/zizmor.yml

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: reberhardt7

.github/workflows/release.yml

@@ -5,10 +5,13 @@ on:
     tags:
       - "v*.*.*"
 
+permissions: {}
+
 jobs:
   test:
     uses: ./.github/workflows/test.yml
-    secrets: inherit
+    secrets:
+      SOCKET_API_KEY: ${{ secrets.SOCKET_API_KEY }}
 
   release:
     runs-on: ubuntu-latest
@@ -21,10 +24,14 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@22457c87c1b161cf7dde222c3e82b2b5f8d2bed2
+        with:
+          no-cache: true
 
       - name: Update npm to latest just to get --provenance
         run: bun install -g npm@latest

.github/workflows/test.yml

@@ -7,6 +7,12 @@ on:
   pull_request:
     branches: [main]
   workflow_call:
+    secrets:
+      SOCKET_API_KEY:
+        required: false
+
+permissions:
+  contents: read
 
 jobs:
   test:
@@ -17,7 +23,9 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Bun
         uses: oven-sh/setup-bun@22457c87c1b161cf7dde222c3e82b2b5f8d2bed2

.github/zizmor.yml

@@ -0,0 +1,3 @@
+rules:
+  secrets-outside-env:
+    disable: true