.beans/nuzlocke-tracker-2zc9--add-zizmor-and-actionlint-to-ci.md

---
# nuzlocke-tracker-2zc9
title: Add zizmor and actionlint to CI
status: completed
type: task
priority: normal
created_at: 2026-02-16T19:13:50Z
updated_at: 2026-02-16T19:26:23Z
parent: nuzlocke-tracker-a5es
---

Global standards require scanning GitHub Actions workflows with zizmor (security audit) and actionlint (linter).

## Checklist
- [ ] Add actionlint check to CI
- [ ] Add zizmor scan to CI
- [ ] Fix any issues found
Align repo config with global development standards - Add missing tsconfig strictness flags (noUncheckedIndexedAccess, exactOptionalPropertyTypes, noImplicitOverride, noPropertyAccessFromIndexSignature) and fix all resulting type errors - Replace ESLint/Prettier with oxlint 1.48.0 and oxfmt 0.33.0 - Pin all frontend and backend dependencies to exact versions - Pin GitHub Actions to SHA hashes with persist-credentials: false - Fix CI Python version mismatch (3.12 -> 3.14) and ruff target-version - Add vitest 4.0.18 with jsdom environment for frontend testing - Add ty 0.0.17 for Python type checking (non-blocking in CI) - Add actionlint and zizmor CI job for workflow linting and security audit - Add Dependabot config for npm, pip, and github-actions - Update CLAUDE.md and pre-commit hooks to reflect new tooling - Ignore Claude Code sandbox artifacts in gitignore Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> 2026-02-16 20:39:41 +01:00			`---`
			`# nuzlocke-tracker-2zc9`
			`title: Add zizmor and actionlint to CI`
			`status: completed`
			`type: task`
			`priority: normal`
			`created_at: 2026-02-16T19:13:50Z`
			`updated_at: 2026-02-16T19:26:23Z`
			`parent: nuzlocke-tracker-a5es`
			`---`

			`Global standards require scanning GitHub Actions workflows with zizmor (security audit) and actionlint (linter).`

			`## Checklist`
			`- [ ] Add actionlint check to CI`
			`- [ ] Add zizmor scan to CI`
			`- [ ] Fix any issues found`