Initial workflows static analysis fixes (#39097)

* Initial zizmor findings

* add rule about action hashes

* add comment

* fix another workflow

* redo build release candidate workflow after change

* another fix

* add more initial findings

* fix more zizmor initial issues after merge conflict resolution

* chore: empty commit

Author: derrickaw

.github/workflows/IO_Iceberg_Integration_Tests.yml

@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Integration Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -75,4 +77,4 @@ jobs:
       - name: Run IcebergIO Integration Test
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:java:io:iceberg:integrationTest --info
+          gradle-command: :sdks:java:io:iceberg:integrationTest --info

.github/workflows/IO_Iceberg_Integration_Tests_Dataflow.yml

@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Integration Tests on Dataflow"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -75,4 +77,4 @@ jobs:
       - name: Run IcebergIO Integration Tests on Dataflow
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:java:io:iceberg:dataflowIntegrationTest --info
+          gradle-command: :sdks:java:io:iceberg:dataflowIntegrationTest --info

.github/workflows/IO_Iceberg_Managed_Integration_Tests_Dataflow.yml

@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Managed Integration Tests on Dataflow"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -78,4 +80,4 @@ jobs:
           gradle-command: :sdks:java:io:iceberg:dataflowIntegrationTest
           arguments: |
             --info \
-            -PenableManagedTransforms
+            -PenableManagedTransforms

.github/workflows/IO_Iceberg_Performance_Tests.yml

@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -75,4 +77,4 @@ jobs:
       - name: Run IcebergIO Performance Test
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:java:io:iceberg:loadTest
+          gradle-command: :sdks:java:io:iceberg:loadTest

.github/workflows/IO_Iceberg_Unit_Tests.yml

@@ -83,6 +83,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/assign_milestone.yml

@@ -34,6 +34,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 2
+          persist-credentials: false
 
       - uses: actions/github-script@v9
         with:

.github/workflows/beam_CancelStaleDataflowJobs.yml

@@ -63,6 +63,8 @@ jobs:
       github.event.comment.body == 'Run Cancel Stale Dataflow Jobs'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/beam_CleanUpDataprocResources.yml

@@ -56,6 +56,8 @@ jobs:
     name: "beam_CleanUpDataprocResources"
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Delete leaked resources for all the jobs that generates flink clusters
         run: |
-          cd ${{ github.workspace }}/.test-infra/dataproc; ./cleanup.sh -xe
+          cd ${{ github.workspace }}/.test-infra/dataproc; ./cleanup.sh -xe

.github/workflows/beam_CleanUpGCPResources.yml

@@ -63,6 +63,8 @@ jobs:
       github.event.comment.body == 'Run Clean GCP Resources'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/beam_CleanUpPrebuiltSDKImages.yml

@@ -63,6 +63,8 @@ jobs:
       github.event.comment.body == 'Run Clean Prebuilt Images'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -80,4 +82,4 @@ jobs:
       - name: run remove stale sdk container images
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :beam-test-tools:removeStaleSDKContainerImages
+          gradle-command: :beam-test-tools:removeStaleSDKContainerImages