[kratsg]

Summary

• Pin all 7 GitHub Actions used in build-images.yaml to full commit SHAs (with version comments), via actions-up.
• Add persist-credentials: false to the actions/checkout step (zizmor artipacked).
• Add an inline comment explaining the packages: write job permission (zizmor undocumented-permissions).
• Set a 7-day cooldown on the GitHub Actions Dependabot group and rename the group from actions to github-actions (zizmor dependabot-cooldown).
• Add a 7-day exclude-newer cooldown to the pixi [workspace] table in pixi.toml, so future pixi.lock updates won't resolve a conda-forge/PyPI package published in the last week.

uvx zizmor --persona=pedantic .github reports no findings after these changes.

Major version changes

actions-up bumped every pinned action by a major version (all releases are older than the 7-day cooldown):

• actions/checkout v6 -> v7.0.1
• docker/setup-buildx-action v3 -> v4.2.0
• docker/login-action v3 -> v4.6.0
• docker/metadata-action v5 -> v6.2.0
• docker/build-push-action v6 -> v7.3.0

Each SHA was independently verified against the corresponding GitHub release tag. No changelog-breaking inputs/outputs for this workflow's usage were found, but please double check the image build/push still behaves as expected since this is the only workflow in the repo.

Note: there is an existing open Dependabot PR (dependabot/github_actions/actions-6534b7915f) bumping the same actions to unpinned major versions. It will likely go stale/be superseded once this merges; Dependabot should recreate it against the new pinned SHAs on its next run if there's anything further to bump.

Held-back items

• Isolating the build and push into separate jobs (skill step 5): this is a single-job workflow that builds a large CUDA/TensorFlow/ROOT ML image and pushes it to three registries. The push steps are already gated behind if: github.event_name != 'pull_request', so there's no untrusted-code-with-deploy-credentials exposure today. Splitting build/push would require shuttling a multi-GB image through GitHub Actions artifacts between jobs, which is impractical for an image this size and risks breaking the pipeline for no real security gain here. Left as-is; flagging in case a registry-mirroring or layer-caching strategy is wanted later.

zizmor ignores

None added — all findings were fixed directly rather than ignored.

Verification

• uvx zizmor --persona=pedantic .github -> no findings.
• No pre-commit config exists in this repo, so no pre-commit/prek changes were made (per scope).
• All workflow uses: refs are full 40-character SHAs with a version comment; verified none are tags or branches.