fix: resolve all Zizmor GitHub Actions security findings

Author: cx-atish-jadhav

.github/workflows/checkmarx-one-scan.yml

@@ -8,6 +8,10 @@ on:
   schedule:
     - cron: "00 7 * * *" # Every day at 07:00
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 

.github/workflows/ci.yml

@@ -2,11 +2,16 @@ name: AST Java Wrapper CI
 
 on: [ pull_request ]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
 jobs:
   integration-tests:
+    name: Integration Tests
     permissions:
       contents: read
     runs-on: cx-public-ubuntu-x64

.github/workflows/manual-tag.yml

@@ -7,29 +7,37 @@ on:
         description: 'Next release tag'
         required: true
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
 jobs:
   tag-creation:
+    name: Tag Creation
     permissions:
       contents: write  # for Git to git push
     runs-on: cx-public-ubuntu-x64
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: false
       - name: Tag
         env:
           INPUT_TAG: ${{ github.event.inputs.tag }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           PR_TITLE: ${{ github.event.pull_request.title }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
         run: |
           echo "$INPUT_TAG"
           echo "NEXT_VERSION=$INPUT_TAG" >> $GITHUB_ENV
           message="$INPUT_TAG: PR #$PR_NUMBER $PR_TITLE"
           git config user.name "${GITHUB_ACTOR}"
           git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}"
           git tag -a "$INPUT_TAG" -m "$message"
           git push origin "$INPUT_TAG"

.github/workflows/nightly.yml

@@ -6,20 +6,26 @@ on:
   #   branches:
   #     - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
 jobs:
   delete_tag:
+    name: Delete Tag
     permissions:
-      contents: write
+      contents: write  # for gh release delete to remove tags and releases
     runs-on: cx-public-ubuntu-x64
     steps:
       - name: Delete release and tag
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
         run: |
-          gh release delete "1.0.0-SNAPSHOT" --yes --cleanup-tag --repo ${{ github.repository }} || true
+          gh release delete "1.0.0-SNAPSHOT" --yes --cleanup-tag --repo "${GH_REPO}" || true
 
   nightly:
     needs: delete_tag

.github/workflows/release.yml

@@ -53,14 +53,19 @@ on:
       ECHO_LIBRARIES_ACCESS_KEY:
         required: true
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
 jobs:
   release:
+    name: Release
     permissions:
-      id-token: write
-      contents: write
+      id-token: write  # for Maven Central publishing via OIDC
+      contents: write  # for git push tag and creating GitHub release
     runs-on: cx-public-ubuntu-x64
     outputs:
       CLI_VERSION: ${{ steps.extract_cli_version.outputs.CLI_VERSION }}
@@ -69,8 +74,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
           lfs: true
+          persist-credentials: false
 
       - name: Download CLI
         if: inputs.cliTag
@@ -107,11 +112,14 @@ jobs:
         id: set_tag_name
         env:
           INPUT_TAG: ${{ inputs.tag }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REPO: ${{ github.repository }}
         run: |
           echo "$INPUT_TAG"
           echo "RELEASE_VERSION=$INPUT_TAG" >> $GITHUB_ENV
           git config user.name "${GITHUB_ACTOR}"
           git config user.email "${GITHUB_ACTOR}@users.noreply.github.com"
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${REPO}"
           git tag -a "$INPUT_TAG" -m "$INPUT_TAG"
           git push origin "$INPUT_TAG"
           echo "TAG_NAME=$INPUT_TAG" >> $GITHUB_OUTPUT

.github/workflows/update-cli.yml

@@ -3,11 +3,16 @@ name: Update checkmarx ast cli
 on:
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 permissions:
   contents: read
 
 jobs:
   update_cli:
+    name: Update CLI
     runs-on: cx-public-ubuntu-x64
     steps:
       - name: Checkout