From 8dd8e3ba3655b29ade0ec949a60f4b3244e8668b Mon Sep 17 00:00:00 2001
From: Wes Tarle <westarle@google.com>
Date: Wed, 5 Aug 2026 11:54:06 +0000
Subject: [PATCH] ci: resolve zizmor security analysis findings in GitHub
 Actions

- Pin GitHub Actions to exact SHA digests across all workflows
- Set persist-credentials: false on actions/checkout steps
- Add explicit permissions block to update-apis.yaml
---
 .github/workflows/issues-no-repro.yaml |  8 +++++---
 .github/workflows/response.yaml        | 12 ++++++++----
 .github/workflows/update-apis.yaml     |  5 ++++-
 3 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/issues-no-repro.yaml b/.github/workflows/issues-no-repro.yaml
index 978863915b1..31a1386a6ef 100644
--- a/.github/workflows/issues-no-repro.yaml
+++ b/.github/workflows/issues-no-repro.yaml
@@ -10,13 +10,15 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 18
       - run: npm install
         working-directory: ./.github/scripts
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const script = require('./.github/scripts/close-invalid-link.cjs')
diff --git a/.github/workflows/response.yaml b/.github/workflows/response.yaml
index e81a3603af5..5954f58a968 100644
--- a/.github/workflows/response.yaml
+++ b/.github/workflows/response.yaml
@@ -13,8 +13,10 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/github-script@v7
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const script = require('./.github/scripts/close-unresponsive.cjs')
@@ -27,8 +29,10 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/github-script@v7
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5
+        with:
+          persist-credentials: false
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const script = require('./.github/scripts/remove-response-label.cjs')
diff --git a/.github/workflows/update-apis.yaml b/.github/workflows/update-apis.yaml
index 8da90517e1d..a0b21e51253 100644
--- a/.github/workflows/update-apis.yaml
+++ b/.github/workflows/update-apis.yaml
@@ -3,11 +3,14 @@ on:
     - cron: "0 1 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   update-apis:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 22
       - run: gh repo fork googleapis/google-api-nodejs-client --fork-name google-api-nodejs-client-autodisco --clone