chore(actions): address zizmor findings

.github/workflows/conformance-tests-bigtable-proxy.yaml

@@ -13,6 +13,9 @@
 # limitations under the License.
 # Github action job to test core java library features on
 # downstream client libraries before they are released.
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -31,22 +34,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
           extensions: grpc
 
       - name: Checkout Bigtable conformance tests
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           repository: googleapis/cloud-bigtable-clients-test
           ref: v0.0.3
           path: cloud-bigtable-clients-test
+          persist-credentials: false
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version: '>=1.20.2'
 

.github/workflows/conformance-tests-gax-showcase.yaml

@@ -16,10 +16,12 @@ jobs:
         name: GAPIC Showcase Conformance Tests
         steps:
         - name: Checkout code
-          uses: actions/checkout@v7
+          uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+          with:
+            persist-credentials: false
 
         - name: Setup PHP
-          uses: shivammathur/setup-php@v2
+          uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
           with:
             php-version: '8.1'
             extensions: grpc

.github/workflows/conformance-tests-storage-emulator.yaml

@@ -1,3 +1,6 @@
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -22,10 +25,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
 

.github/workflows/docs.yaml

@@ -1,3 +1,6 @@
+permissions:
+  contents: read
+
 name: DocFX Test Suite
 on:
   push:
@@ -12,26 +15,30 @@ jobs:
     env:
       PHPDOC_ENV: prod
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      with:
+        persist-credentials: false
     - name: Setup Python
-      uses: actions/setup-python@v6
+      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
       with:
         python-version: '3.14'
     - run: pip install --no-deps --require-hashes -r .kokoro/docs/docker/requirements.txt
     - name: Setup PHP
-      uses: shivammathur/setup-php@verbose
+      uses: shivammathur/setup-php@verbose # zizmor: ignore[unpinned-uses]
       with:
         php-version: "8.2"
     - name: Extract phpDocumentor
       id: extract
-      uses: shrink/actions-docker-extract@v4
+      uses: shrink/actions-docker-extract@f1ef61065b78731fe3310b4e84e511f6a927a77e # v4
       with:
         image: "phpdoc/phpdoc:3.5.3"
         path: "/opt/phpdoc/."
     - name: Symlink phpDocumentor
-      run: ln -s $(pwd)/${{ steps.extract.outputs.destination }}/bin/phpdoc /usr/local/bin/phpdoc
+      run: ln -s $(pwd)/${STEPS_EXTRACT_OUTPUTS_DESTINATION}/bin/phpdoc /usr/local/bin/phpdoc
+      env:
+        STEPS_EXTRACT_OUTPUTS_DESTINATION: ${{ steps.extract.outputs.destination }}
     - name: Install Dependencies
-      uses: nick-invision/retry@v4
+      uses: nick-invision/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
       with:
         timeout_minutes: 10
         max_attempts: 3

.github/workflows/emulator-system-tests-bigtable.yaml

@@ -19,12 +19,14 @@ jobs:
     name: Bigtable
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - run: ./.github/emulator/start-emulator.sh bigtable 522.0.0-emulators
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
           tools: pecl

.github/workflows/emulator-system-tests-datastore.yaml

@@ -19,12 +19,14 @@ jobs:
     name: Datastore
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - run: ./.github/emulator/start-emulator.sh datastore 522.0.0-emulators
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
           tools: pecl

.github/workflows/emulator-system-tests-firestore.yaml

@@ -19,12 +19,14 @@ jobs:
     name: Firestore
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - run: ./.github/emulator/start-emulator.sh firestore 522.0.0-emulators
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
           tools: pecl

.github/workflows/emulator-system-tests-pubsub.yaml

@@ -19,12 +19,14 @@ jobs:
     name: PubSub
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - run: ./.github/emulator/start-emulator.sh pubsub
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
           tools: pecl

.github/workflows/emulator-system-tests-spanner.yaml

@@ -25,10 +25,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Create Spanner instance
-        uses: google-github-actions/setup-gcloud@v3
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3
         with:
           version: '516.0.0'
       - run: gcloud info
@@ -39,7 +41,7 @@ jobs:
       - run: gcloud spanner instances create google-cloud-php-system-tests --config=emulator-config --description="Test Instance" --nodes=1
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.4'
           ini-values: grpc.enable_fork_support=1

.github/workflows/lint.yaml

@@ -12,9 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     name: PHP Style Check
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      with:
+        persist-credentials: false
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
       with:
         php-version: '8.1'
     - name: Install Dependencies
@@ -24,7 +26,7 @@ jobs:
 
   style_csfixer:
     name: PHP CS Fixer
-    uses: GoogleCloudPlatform/php-tools/.github/workflows/code-standards.yml@main
+    uses: GoogleCloudPlatform/php-tools/.github/workflows/code-standards.yml@main # zizmor: ignore[unpinned-uses]
     with:
       config: GoogleCloudPlatform/php-tools/.php-cs-fixer.default.php@main
       exclude-patterns: |
@@ -52,9 +54,11 @@ jobs:
     runs-on: ubuntu-latest
     name: PHPStan Static Analysis
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      with:
+        persist-credentials: false
     - name: Install PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
       with:
         php-version: '8.2'
     - name: "Install dependencies"

.github/workflows/major-version-approval.yaml

@@ -19,7 +19,7 @@ jobs:
     if: github.event.pull_request.user.login == 'release-please[bot]' && contains(github.event.pull_request.body, 'MAJOR_VERSION_ALLOWED=')
     steps:
       - name: Run Approval Check
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         env:
           GH_TOKEN: ${{ secrets.SPLIT_TOKEN }}
         with:

.github/workflows/owlbot-checks.yaml

@@ -1,3 +1,6 @@
+permissions:
+  contents: read
+
 name: OwlBot Checks
 on:
   pull_request:
@@ -12,11 +15,12 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.user.login == 'gcf-owl-bot[bot]'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: "Install PHP"
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: "8.1"
       - name: "Install dependencies"
@@ -25,13 +29,15 @@ jobs:
         id: compatibility-checker
         continue-on-error: true
         # OwlBot PRs which are not labelled feat should not add new files or methods
+        env:
+          PR_REF: ${{ github.head_ref || github.ref_name }}
         run: |
           ~/.composer/vendor/bin/roave-backward-compatibility-check \
-            --from=origin/${{ github.head_ref || github.ref_name }} \
+            --from=origin/"$PR_REF" \
             --to=origin/main
       - name: "Print the action item"
         run: |
-          if [[ "${{ steps.compatibility-checker.outcome }}" == 'failure' ]]; then
+          if [[ "${STEPS_COMPATIBILITY_CHECKER_OUTCOME}" == 'failure' ]]; then
             if [[ "${{ startsWith(github.event.pull_request.title, 'feat') }}" == "false" ]]; then
               echo "Action item: Change the conventional commit to use 'feat'"
               exit 1
@@ -40,14 +46,18 @@ jobs:
             echo "Action item: No features found, do not use 'feat' for the conventional commit"
             exit 1
           fi
+        env:
+          STEPS_COMPATIBILITY_CHECKER_OUTCOME: ${{ steps.compatibility-checker.outcome }}
 
   # Ensure the "owl-bot-staging" directory doesn't exist
   owl-bot-staging-directory-check:
     name: owl-bot-staging check
     runs-on: ubuntu-latest
     if: github.event.pull_request.user.login == 'gcf-owl-bot[bot]' && github.event.pull_request.draft == false
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
       - name: Ensure
         run: |
           directory_to_check="owl-bot-staging"