From e7c2adc89c3ec5e3887e2599eb8ceadfda1c9667 Mon Sep 17 00:00:00 2001
From: Husam <husameldawi@google.com>
Date: Tue, 30 Jun 2026 01:45:18 +0000
Subject: [PATCH] chore(actions): address zizmor findings

This PR is an AI assisted attempt to address zizmor findings. It may not catch everything, and should be reviewed by repository owners. If it is unhelpful, feel free to close the PR and address separately. If it is helpful, feel free to approve and merge, or edit/modify as needed to get it to the right state. Repository owners must ultimately ensure compliance by 2026-07-13. The purpose of this PR is to provide some assistance with achieving that as a first pass. This will become a blocking check for new changes to github workflows on 2026-07-13.
---
 .github/workflows/ci.yml                      | 11 +++++++++--
 .github/workflows/generate-updates.yml        |  9 +++++++--
 .github/workflows/release-freeze.yml          |  9 +++++++--
 .github/workflows/release-unfreeze.yml        |  9 +++++++--
 .github/workflows/weekly-generate-updates.yml |  9 +++++++--
 5 files changed, 37 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 408fab29045..2e37be276a3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,7 @@
 name: CI
+
+permissions:
+  contents: read
 on:
   pull_request:
     branches:
@@ -36,9 +39,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout repo
-      uses: actions/checkout@v2
+      uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
+      with:
+        persist-credentials: false
     - name: Install Ruby ${{ matrix.ruby }}
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
       with:
         ruby-version: "${{ matrix.ruby }}"
     - name: Install tools
@@ -49,11 +54,13 @@ jobs:
       # See https://github.com/actions/runner-images/issues/10215
       # and https://github.com/rubygems/rubygems/issues/7983.
       shell: bash
+      # zizmor: ignore[template-injection]
       run: |
         if [ -d /opt/hostedtoolcache/Ruby ]; then
           chmod -R o-w /opt/hostedtoolcache/Ruby
         fi
     - name: Test ${{ matrix.task }} ${{ matrix.rubyopt }}
+      # zizmor: ignore[template-injection]
       run: |
         toys ci -v --only ${{ matrix.task }} --github-event-name=${{ github.event_name }} --github-event-payload=${{ github.event_path }}
       env:
diff --git a/.github/workflows/generate-updates.yml b/.github/workflows/generate-updates.yml
index 3af16b3fe7d..1bc30397c3c 100644
--- a/.github/workflows/generate-updates.yml
+++ b/.github/workflows/generate-updates.yml
@@ -1,4 +1,7 @@
 name: Generate-Updates
+
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:
@@ -14,9 +17,11 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.YOSHI_CODE_BOT_TOKEN }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - name: Install Ruby 4.0
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
         with:
           ruby-version: "4.0"
       - name: Install tools
diff --git a/.github/workflows/release-freeze.yml b/.github/workflows/release-freeze.yml
index 6d7a08aa9f8..25d8a322df1 100644
--- a/.github/workflows/release-freeze.yml
+++ b/.github/workflows/release-freeze.yml
@@ -1,4 +1,7 @@
 name: Freeze releases
+
+permissions:
+  contents: read
 on:
   workflow_dispatch:
 
@@ -10,9 +13,11 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.YOSHI_CODE_BOT_TOKEN }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - name: Install Ruby 4.0
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
         with:
           ruby-version: "4.0"
       - name: Install tools
diff --git a/.github/workflows/release-unfreeze.yml b/.github/workflows/release-unfreeze.yml
index 4b2201fe3fe..450339c1919 100644
--- a/.github/workflows/release-unfreeze.yml
+++ b/.github/workflows/release-unfreeze.yml
@@ -1,4 +1,7 @@
 name: Unfreeze releases
+
+permissions:
+  contents: read
 on:
   workflow_dispatch:
 
@@ -10,9 +13,11 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.YOSHI_CODE_BOT_TOKEN }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - name: Install Ruby 4.0
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
         with:
           ruby-version: "4.0"
       - name: Install tools
diff --git a/.github/workflows/weekly-generate-updates.yml b/.github/workflows/weekly-generate-updates.yml
index 7df8997424c..acdf616babf 100644
--- a/.github/workflows/weekly-generate-updates.yml
+++ b/.github/workflows/weekly-generate-updates.yml
@@ -1,4 +1,7 @@
 name: Weekly-Generate-Updates
+
+permissions:
+  contents: read
 on:
   schedule:
     - cron: '02 9 * * 0'
@@ -11,9 +14,11 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.YOSHI_CODE_BOT_TOKEN }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - name: Install Ruby 4.0
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
         with:
           ruby-version: "4.0"
       - name: Install tools