Address zizmor GitHub Actions findings

Fixes findings identified by zizmor (https://github.com/zizmorcore/zizmor)

Signed-off-by: nscuro <nscuro@protonmail.com>

Author: nscuro

.github/dependabot.yml

@@ -5,14 +5,20 @@ updates:
   directory: /
   schedule:
     interval: daily
+  cooldown:
+    default-days: 7
 - package-ecosystem: docker
   directory: /docker
   schedule:
     interval: daily
+  cooldown:
+    default-days: 7
 - package-ecosystem: github-actions
   directory: /
   schedule:
     interval: daily
+  cooldown:
+    default-days: 7
 # Receive minor and patch updates on latest release branch.
 # Ignore minor releases for NPM since they may ship breaking
 # changes, and we don't have the test coverage in place to
@@ -22,6 +28,8 @@ updates:
   directory: /
   schedule:
     interval: daily
+  cooldown:
+    default-days: 7
   ignore:
   - dependency-name: "*"
     update-types:
@@ -32,6 +40,8 @@ updates:
   directory: /docker
   schedule:
     interval: daily
+  cooldown:
+    default-days: 7
   ignore:
   - dependency-name: "*"
     update-types:

.github/workflows/_meta-build.yaml

@@ -30,6 +30,8 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up NodeJs
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # tag=v6.3.0
@@ -60,6 +62,8 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Download Artifacts
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # tag=v8.0.0
@@ -85,16 +89,18 @@ jobs:
 
       - name: Set Container Tags
         id: tags
+        env:
+          REF_NAME: ${{ inputs.ref-name }}
+          APP_VERSION: ${{ inputs.app-version }}
         run: |-
           IMAGE_NAME="docker.io/dependencytrack/frontend"
-          REF_NAME="${{ inputs.ref-name }}"
           TAGS=""
 
           if [[ $REF_NAME == feature-* ]]; then
             TAGS="${IMAGE_NAME}:${REF_NAME,,}"
           else
-            TAGS="${IMAGE_NAME}:${{ inputs.app-version }}"
-            if [[ "${{ inputs.app-version }}" != "snapshot" ]]; then
+            TAGS="${IMAGE_NAME}:${APP_VERSION}"
+            if [[ "${APP_VERSION}" != "snapshot" ]]; then
               TAGS="${TAGS},${IMAGE_NAME}:latest"
             fi
           fi

.github/workflows/ci-publish.yaml

@@ -23,6 +23,8 @@ jobs:
 
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Parse Version from package.json
         id: parse
@@ -52,6 +54,8 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Download Artifacts
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # tag=v8.0.0
@@ -72,20 +76,21 @@ jobs:
       - name: Update Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_VERSION: ${{ needs.read-version.outputs.version }}
         run: |-
           cat << EOF >> .github/default-release-notes.md
           \`\`\`text
           $(cat checksums.txt)
           \`\`\`
           EOF
 
-          gh release view ${{ needs.read-version.outputs.version }} \
+          gh release view "${RELEASE_VERSION}" \
             --json body --jq .body >> .github/default-release-notes.md
 
-          gh release edit ${{ needs.read-version.outputs.version }} \
+          gh release edit "${RELEASE_VERSION}" \
             --notes-file ".github/default-release-notes.md"
 
-          gh release upload ${{ needs.read-version.outputs.version }} \
+          gh release upload "${RELEASE_VERSION}" \
             --clobber \
             frontend-dist.zip \
             checksums.txt \
@@ -94,6 +99,7 @@ jobs:
       - name: Publish Release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          RELEASE_VERSION: ${{ needs.read-version.outputs.version }}
         run: |-
-          gh release edit ${{ needs.read-version.outputs.version }} \
+          gh release edit "${RELEASE_VERSION}" \
             --draft=false

.github/workflows/ci-release.yaml

@@ -34,27 +34,32 @@ jobs:
           cache: 'npm'
 
       - name: Bump version and tag via NodeJS
+        env:
+          VERSION_TO_BUMP: ${{ github.event.inputs.version-to-bump }}
+          GIT_REF: ${{ github.ref }}
         run: |-
           git config user.name "dependencytrack-bot"
           git config user.email "106437498+dependencytrack-bot@users.noreply.github.com"
 
-          npm version ${{ github.event.inputs.version-to-bump }} -m "prepare-release: set version to %s"
+          npm version "${VERSION_TO_BUMP}" -m "prepare-release: set version to %s"
 
-          git push origin "HEAD:${{ github.ref }}"
+          git push origin "HEAD:${GIT_REF}"
 
       - name: Create GitHub Release
         env:
           GITHUB_TOKEN: ${{ secrets.BOT_RELEASE_TOKEN }}
-          GH_OPTS: ''
+          VERSION_TO_BUMP: ${{ github.event.inputs.version-to-bump }}
+          GIT_REF_NAME: ${{ github.ref_name }}
         run: |-
           VERSION=`jq -r '.version' package.json`
+          GH_OPTS=""
 
-          if [[ "${{ contains(github.event.inputs.version-to-bump, 'pre') }}" == "true" ]]; then
+          if [[ "${VERSION_TO_BUMP}" == *pre* ]]; then
             GH_OPTS="--prerelease"
           fi
 
           gh release create "${VERSION}" ${GH_OPTS} \
-            --target "${{ github.ref_name }}" \
+            --target "${GIT_REF_NAME}" \
             --title "${VERSION}" \
             --draft \
             --generate-notes

.github/workflows/i18n.yaml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up NodeJs
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # tag=v6.3.0

.github/workflows/lint.yaml

@@ -18,6 +18,8 @@ jobs:
     steps:
       - name: Checkout Repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # tag=v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up NodeJs
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # tag=v6.3.0