From 98cae39758a66d7e21ac5654da20dca629ace62f Mon Sep 17 00:00:00 2001
From: Yuan Teoh <yuanteoh@google.com>
Date: Thu, 9 Jul 2026 14:04:06 -0700
Subject: [PATCH] chore(ci): zizmor auto and manual fix to harden workflows

---
 .github/workflows/cloud_build_failure_reporter.yml | 8 +++++---
 .github/workflows/compile.yml                      | 9 +++++++--
 .github/workflows/lint.yml                         | 6 ++++--
 .github/workflows/sync-labels.yaml                 | 4 +++-
 4 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/cloud_build_failure_reporter.yml b/.github/workflows/cloud_build_failure_reporter.yml
index 0fbda0f..fe156eb 100644
--- a/.github/workflows/cloud_build_failure_reporter.yml
+++ b/.github/workflows/cloud_build_failure_reporter.yml
@@ -38,10 +38,12 @@ jobs:
 
     steps:
       - uses: 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd' # v8
+        env:
+          TRIGGER_NAMES: ${{ inputs.trigger_names }}
         with:
           script: |-
                   // parse test names
-                  const testNameSubstring = '${{ inputs.trigger_names }}';
+                  const testNameSubstring = process.env.TRIGGER_NAMES;
                   const testNameFound = new Map(); //keeps track of whether each test is found
                   testNameSubstring.split(',').forEach(testName => {
                     testNameFound.set(testName, false);
@@ -171,8 +173,8 @@ jobs:
                   const noTestFound = Array.from(testNameFound.values()).every(value => value === false);
                   if (noTestFound){
                     createOrCommentIssue(
-                      'Missing periodic tests: ${{ inputs.trigger_names }}',
-                      `No periodic test is found for triggers: ${{ inputs.trigger_names }}. Last checked from ${
+                      'Missing periodic tests: ${process.env.TRIGGER_NAMES}',
+                      `No periodic test is found for triggers: ${process.env.TRIGGER_NAMES}. Last checked from ${
                         commits[0].html_url
                       } to ${commits[commits.length - 1].html_url}.`
                     );
diff --git a/.github/workflows/compile.yml b/.github/workflows/compile.yml
index 7dfb8e1..e1999b3 100644
--- a/.github/workflows/compile.yml
+++ b/.github/workflows/compile.yml
@@ -6,15 +6,20 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
 
     - name: Set up JDK 17
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         java-version: '17'
         distribution: 'temurin'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index c7c8571..8c95014 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -26,9 +26,11 @@ jobs:
 
     steps:
     - name: Checkout Repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      with:
+        persist-credentials: false
     - name: Set up JDK 17
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
       with:
         java-version: '17'
         distribution: 'temurin'
diff --git a/.github/workflows/sync-labels.yaml b/.github/workflows/sync-labels.yaml
index eb55fc3..78ec1bf 100644
--- a/.github/workflows/sync-labels.yaml
+++ b/.github/workflows/sync-labels.yaml
@@ -30,8 +30,10 @@ jobs:
       pull-requests: 'write'
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - uses: micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c # v1.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
-          manifest: .github/labels.yml
\ No newline at end of file
+          manifest: .github/labels.yml