From 05c2406d6ed98526759f059b5bb2911d674d74b1 Mon Sep 17 00:00:00 2001
From: Izaak Gough <izaak.gough@invertase.io>
Date: Thu, 13 Aug 2026 10:46:37 +0100
Subject: [PATCH] ci: satisfy zizmor policy in remaining workflows

The GitHub Actions Scan check runs zizmor over any workflow file a PR
touches, and fails on its mandatory rules and on medium findings.
validate.yml was already brought in line; this does the same for the
other four.

Actions are pinned to the commit each moving tag resolves to today, so
nothing changes about what runs. Adds read-only permissions blocks to
test.yml and readmes-updated.yml, contents: write to release.yml since
it creates releases, and passes a step output through env in
readmes-updated.yml instead of interpolating it into the run body.

Verified with zizmor 1.25.2 and the org config the check downloads: no
mandatory or medium findings remain.
---
 .github/workflows/npm_publish_bq_scripts.yml |  4 ++--
 .github/workflows/readmes-updated.yml        | 13 +++++++++----
 .github/workflows/release.yml                |  5 ++++-
 .github/workflows/test.yml                   |  9 ++++++---
 4 files changed, 21 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/npm_publish_bq_scripts.yml b/.github/workflows/npm_publish_bq_scripts.yml
index abc3624552..148fd1c3f2 100644
--- a/.github/workflows/npm_publish_bq_scripts.yml
+++ b/.github/workflows/npm_publish_bq_scripts.yml
@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     name: publish_if_newer_version
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 24
       - name: NPM install
diff --git a/.github/workflows/readmes-updated.yml b/.github/workflows/readmes-updated.yml
index 6bd0b17030..bef917d39c 100644
--- a/.github/workflows/readmes-updated.yml
+++ b/.github/workflows/readmes-updated.yml
@@ -17,20 +17,23 @@ concurrency:
 env:
   BRANCH_NAME: ${{ github.head_ref || github.ref_name }}
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
           ref: ${{ github.event.pull_request.head.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 22
           cache: "npm"
@@ -44,7 +47,7 @@ jobs:
           echo "::set-output name=dir::$(npm config get prefix)"
 
       - name: Cache global dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ steps.global-deps-setup.outputs.dir }}
           key:
@@ -54,8 +57,10 @@ jobs:
             ${{ runner.os }}-npm-global-deps-v1-
 
       - name: Install Firebase and Lerna
+        env:
+          NPM_GLOBAL_PREFIX: ${{ steps.global-deps-setup.outputs.dir }}
         run: |
-          echo "${{ steps.global-deps-setup.outputs.dir }}/bin" >> $GITHUB_PATH
+          echo "${NPM_GLOBAL_PREFIX}/bin" >> "$GITHUB_PATH"
           npm install -g firebase-tools lerna
 
       - name: Install local dependencies
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e7735bc6d7..8839355e7d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,12 +5,15 @@ on:
     branches:
       - master
 
+permissions:
+  contents: write
+
 jobs:
   release:
     name: "Create Releases"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Release Script
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 89832a64ae..ceb0b31ab1 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ["**"]
 
+permissions:
+  contents: read
+
 jobs:
   nodejs:
     runs-on: ubuntu-latest
@@ -14,9 +17,9 @@ jobs:
         node: ["22"]
     name: node.js_${{ matrix.node }}_test
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - name: Setup node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: ${{ matrix.node }}
           cache: "npm"
@@ -26,7 +29,7 @@ jobs:
       - name: Build emulator functions
         run: cd _emulator/functions && npm i && npm run build & cd ../..
       - name: Install Firebase CLI
-        uses: nick-invision/retry@v1
+        uses: nick-invision/retry@39da88d5f7d15a96aed861dbabbe8b7443e3182a # v1.0.4
         with:
           timeout_minutes: 10
           retry_wait_seconds: 60