ci: fix zizmor issues

Author: lhoupert

.github/workflows/benchmark.yml

@@ -15,8 +15,8 @@ jobs:
     if: github.repository == 'developmentseed/titiler'
     runs-on: ubuntu-latest
     permissions:
-      contents: write
-      pull-requests: write
+      contents: write # Push benchmark results to gh-benchmarks branch
+      pull-requests: write # Leave PR comments when benchmark regressions exceed alert threshold
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

.github/workflows/ci.yml

@@ -94,7 +94,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      packages: write
+      packages: write # Push multi-arch images to ghcr.io for this repository
     strategy:
       matrix:
         include:

.github/workflows/deploy.yml

@@ -14,7 +14,7 @@ jobs:
       run:
         working-directory: deployment/aws
     permissions:
-      id-token: write
+      id-token: write # AWS OIDC: exchange JWT for temporary credentials in configure-aws-credentials
       contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
@@ -47,8 +47,10 @@ jobs:
 
       # Build and Deploy CDK application
       - name: Build & Deploy
-        run: uv run cdk deploy ${{ secrets.STACK_NAME }}-lambda-${{ secrets.STACK_STAGE }} --require-approval never
+        run: uv run cdk deploy "${STACK_NAME}-lambda-${STACK_STAGE}" --require-approval never
         env:
+          STACK_NAME: ${{ secrets.STACK_NAME }}
+          STACK_STAGE: ${{ secrets.STACK_STAGE }}
           TITILER_STACK_NAME: ${{ secrets.STACK_NAME }}
           TITILER_STACK_STAGE: ${{ secrets.STACK_STAGE }}
           TITILER_STACK_MEMORY: ${{ secrets.STACK_MEMORY }}

.github/workflows/deploy_mkdocs.yml

@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: github-pages
     permissions:
-      contents: write
+      contents: write # mkdocs gh-deploy pushes the built site to gh-pages
     steps:
       - name: Checkout main
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6

.github/workflows/release.yml

@@ -44,9 +44,12 @@ jobs:
           echo "version=$(uv version --short)" >> $GITHUB_OUTPUT
 
       - name: Check version match
+        env:
+          TAG_VERSION: ${{ steps.tag.outputs.version }}
+          MODULE_VERSION: ${{ steps.module.outputs.version }}
         run: |
-          if [ "${{ steps.tag.outputs.version }}" != "${{ steps.module.outputs.version }}" ]; then
-            echo "Tag version (${{ steps.tag.outputs.version }}) does not match module version (${{ steps.module.outputs.version }})"
+          if [ "$TAG_VERSION" != "$MODULE_VERSION" ]; then
+            echo "Tag version ($TAG_VERSION) does not match module version ($MODULE_VERSION)"
             exit 1
           fi
 
@@ -66,7 +69,7 @@ jobs:
       name: pypi-release
     permissions:
       contents: read
-      id-token: write
+      id-token: write # OIDC token for PyPI trusted publishing (pypa/gh-action-pypi-publish)
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
         with:

.github/workflows/zizmor.yml

@@ -21,8 +21,7 @@ jobs:
     name: Run zizmor
     runs-on: ubuntu-latest
     permissions:
-      # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
-      security-events: write
+      security-events: write # Upload zizmor SARIF to GitHub Code Scanning
       contents: read
     steps:
       - name: Checkout repository