diff --git a/.github/pre-commit.sh b/.github/pre-commit.sh
new file mode 100644
index 0000000..6b6c2e9
--- /dev/null
+++ b/.github/pre-commit.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+ANY_ERROR=false
+
+set +e
+
+if type tofu &>/dev/null; then
+  bash -ex .github/opentofu-fmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+  bash -ex .github/opentofu-validate.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+if type terraform &>/dev/null; then
+  bash -ex .github/terraform-fmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+  bash -ex .github/terraform-validate.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+if type shellcheck &>/dev/null; then
+  bash -ex .github/shellcheck.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+if type shfmt &>/dev/null; then
+  bash -ex .github/shfmt.sh
+  # shellcheck disable=SC2181
+  [[ $? -ne 0 ]] && ANY_ERROR=true
+fi
+
+set -e
+
+if [[ "true" == "$ANY_ERROR" ]]; then
+  exit 1
+fi
diff --git a/README.md b/README.md
index ee5e89c..d528838 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,10 @@
 # iac-github
 
 ```
+# install pre-commit hook, to reduce some github actions cost
+./setup.sh
+
+# format terraform workspace files
 ./tf.sh github/johnko fmt
 
 ./tf.sh github/johnko validate
@@ -9,5 +13,6 @@
 
 ./tf.sh github/johnko apply
 
+# DANGER: this is an apply -auto-approve, no chance to review plan or cancel
 ./tf.sh github/johnko auto
 ```
diff --git a/github/johnko/import.sh b/github/johnko/import.sh
index 5bb5013..6faff42 100644
--- a/github/johnko/import.sh
+++ b/github/johnko/import.sh
@@ -4,14 +4,19 @@ set -euxo pipefail
 $IAC_BIN state show 'github_repository.archived["deploy"]' ||
   $IAC_BIN import 'github_repository.archived["deploy"]' deploy
 
-$IAC_BIN state show 'github_repository.active["homedir"]' ||
-  $IAC_BIN import 'github_repository.active["homedir"]' homedir
+ACTIVE_REPOS="
+homedir
+iac-github
+lab
+renovate-config
+"
 
-$IAC_BIN state show 'github_repository.active["iac-github"]' ||
-  $IAC_BIN import 'github_repository.active["iac-github"]' iac-github
+for i in $ACTIVE_REPOS; do
+  $IAC_BIN state show "github_repository.active[\"$i\"]" ||
+    $IAC_BIN import "github_repository.active[\"$i\"]" "$i"
+done
 
-$IAC_BIN state show 'github_repository.active["lab"]' ||
-  $IAC_BIN import 'github_repository.active["lab"]' lab
-
-$IAC_BIN state show 'github_repository.active["renovate-config"]' ||
-  $IAC_BIN import 'github_repository.active["renovate-config"]' renovate-config
+for i in $ACTIVE_REPOS; do
+  $IAC_BIN state show "github_actions_repository_permissions.active[\"$i\"]" ||
+    $IAC_BIN import "github_actions_repository_permissions.active[\"$i\"]" "$i"
+done
diff --git a/github/johnko/locals-defaults.tf b/github/johnko/locals-defaults.tf
index 479121f..d93ae20 100644
--- a/github/johnko/locals-defaults.tf
+++ b/github/johnko/locals-defaults.tf
@@ -36,9 +36,40 @@ locals {
     }
 
     allow_update_branch = true
+
+    actions = {
+      enabled         = false
+      allowed_actions = "selected"
+      allowed_actions_config = {
+        github_owned_allowed = true
+        patterns_allowed = [
+          "hashicorp/setup-terraform@*",
+          "johnko/*",
+          "opentofu/setup-opentofu@*",
+          "renovatebot/github-action@*",
+        ]
+        verified_allowed = false
+      }
+    }
   }
 
-  all_repos_settings = { for k, v in local.repos : k => merge(local.default_repo_settings, v) }
+  all_repos_settings = { for k, v in local.repos :
+    k => merge(
+      local.default_repo_settings,
+      v,
+      contains(keys(v), "security_and_analysis")
+      ? { "security_and_analysis" : merge(
+        local.default_repo_settings.security_and_analysis,
+        v.security_and_analysis
+      ) }
+      : { "security_and_analysis" : local.default_repo_settings.security_and_analysis },
+      contains(keys(v), "actions")
+      ? { "actions" : merge(
+        local.default_repo_settings.actions,
+        v.actions
+      ) }
+      : { "actions" : local.default_repo_settings.actions }
+  ) }
   active_repos_settings = { for k, v in local.all_repos_settings : k => v
     if v.archived == false
   }
diff --git a/github/johnko/locals.tf b/github/johnko/locals.tf
index 2a69699..88e53f7 100644
--- a/github/johnko/locals.tf
+++ b/github/johnko/locals.tf
@@ -7,18 +7,30 @@ locals {
       has_projects = true
     }
     homedir = {
+      actions = {
+        enabled = true
+      }
       has_issues = true
       visibility = "public"
     }
     iac-github = {
+      actions = {
+        enabled = true
+      }
       has_issues = true
       visibility = "public"
     }
     lab = {
+      actions = {
+        enabled = true
+      }
       has_issues = true
       visibility = "public"
     }
     renovate-config = {
+      actions = {
+        enabled = true
+      }
       description = "RenovateBot config"
       has_issues  = true
       visibility  = "public"
diff --git a/github/johnko/repos-active.tf b/github/johnko/repos-active.tf
index 27ae452..807ac6d 100644
--- a/github/johnko/repos-active.tf
+++ b/github/johnko/repos-active.tf
@@ -58,3 +58,16 @@ resource "github_repository" "active" {
     ]
   }
 }
+
+resource "github_actions_repository_permissions" "active" {
+  for_each = local.active_repos_settings
+
+  repository      = github_repository.active[each.key].name
+  allowed_actions = each.value.actions.allowed_actions
+  enabled         = each.value.actions.enabled
+  allowed_actions_config {
+    github_owned_allowed = each.value.actions.allowed_actions_config.github_owned_allowed
+    patterns_allowed     = each.value.actions.allowed_actions_config.patterns_allowed
+    verified_allowed     = each.value.actions.allowed_actions_config.verified_allowed
+  }
+}
diff --git a/setup.sh b/setup.sh
new file mode 100755
index 0000000..ca7860b
--- /dev/null
+++ b/setup.sh
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euxo pipefail
+
+SCRIPT_DIR=$(dirname "$0")
+pushd "$SCRIPT_DIR"
+
+if [[ -e .github/pre-commit.sh ]]; then
+  install -m 700 .github/pre-commit.sh .git/hooks/pre-commit
+fi