chore(actions): address zizmor findings (#13615)

This PR is an auto-generated attempt to address zizmor findings. It may
not catch everything, and should be reviewed by repository owners.

These changes were generated by running `zizmor --fix=all
--gh-token=$(gh auth token) ./.github/workflows`, and then applying some
fixes for any remaining issues reported by zizmor. See
go/github-zizmor-help for instructions to install and run.

Additionally, it updates renovate configuration (if present) to extend
[best-practices](https://docs.renovatebot.com/presets-config/#configbest-practices),
which includes pinning action digests and image digests, among other
things.

If this PR is unhelpful, feel free to close the PR and address
separately. If it is helpful, feel free to approve and merge, or
edit/modify as needed to get it to the right state. Repository owners
must ultimately ensure compliance by 2026-07-13. The purpose of this PR
is to provide some assistance with achieving that as a first pass. This
will become a blocking check for new changes to github workflows on
2026-07-13 within the `googleapis` org.

There may be some ignored findings (with the comment `# zizmor:
ignore[...]`), which you may fix if feasible.

Author: g-husam

.github/workflows/changelog_generation.yaml

@@ -1,3 +1,6 @@
+permissions:
+  contents: read
+
 on:
   pull_request:
     types:
@@ -23,9 +26,10 @@ jobs:
       github.event.sender.login == 'release-please[bot]' && github.head_ref == 'release-please--branches--main' &&
       contains(github.event.pull_request.labels.*.name, 'autorelease: pending')
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       with:
         ref: ${{ github.head_ref }}
+        persist-credentials: false
     - name: Show status of the branch checked out
       run: |
         git status

.github/workflows/changelog_generation_test.yaml

@@ -1,3 +1,6 @@
+permissions:
+  contents: read
+
 name: CHANGELOG.md generation test
 
 on:
@@ -11,7 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      with:
+        persist-credentials: false
     - name: Unit Test
       run: |
         python3 .github/release-note-generation/unit_test.py

.github/workflows/ci.yaml

@@ -13,6 +13,9 @@
 # limitations under the License.
 # Github action job to test core java library features on
 # downstream client libraries before they are released.
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -32,7 +35,9 @@ jobs:
       # runnable is true if there are changes outside the .github/workflows directory OR if ci.yaml itself (or kokoro scripts) is modified.
       runnable: ${{ fromJSON(steps.filter.outputs.all_count) > fromJSON(steps.filter.outputs.workflows_count) || fromJSON(steps.filter.outputs.ci_count) > 0 }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
       # Use this action, rather than a file filter so that we can make this
       # mandatory.
       # See https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-syntax#example-including-branches
@@ -65,16 +70,18 @@ jobs:
       id: date
       if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       run: echo "::set-output name=week_of_year::$(date +'%W' --utc)"
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
-    - uses: actions/setup-java@v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       with:
         distribution: temurin
         java-version: ${{matrix.java}}
     - run: java -version
       if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
-    - uses: actions/cache@v4
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       id: mvn-cache
       if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       with:
@@ -94,9 +101,11 @@ jobs:
       id: date
       if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       run: echo "::set-output name=week_of_year::$(date +'%W' --utc)"
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
-    - uses: actions/setup-java@v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       with:
         java-version: 8
@@ -107,13 +116,13 @@ jobs:
       if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       run: echo "SUREFIRE_JVM_OPT=-Djvm=${JAVA_HOME}/bin/java" >> $GITHUB_ENV
       shell: bash    
-    - uses: actions/setup-java@v4
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       with:
         java-version: 11
         distribution: temurin
         cache: maven
-    - uses: actions/cache@v4
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       id: mvn-cache
       if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
       with:
@@ -135,7 +144,9 @@ jobs:
     outputs:
       packages: ${{ steps.filter.outputs.changes }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
     - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
@@ -263,8 +274,10 @@ jobs:
     - name: Get current week within the year
       id: date
       run: echo "::set-output name=week_of_year::$(date +'%W' --utc)"
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         distribution: temurin
         java-version: ${{matrix.java}}
@@ -286,14 +299,16 @@ jobs:
     - name: Get current week within the year
       id: date
       run: echo "::set-output name=week_of_year::$(date +'%W' --utc)"
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         java-version: 11
         distribution: temurin
         cache: maven
     - run: java -version
-    - uses: actions/cache@v4
+    - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       id: mvn-cache
       with:
         path: ~/.m2/repository
@@ -304,7 +319,7 @@ jobs:
       env:
         BUILD_SUBDIR: ${{matrix.package}}
         JOB_TYPE: install
-    - uses: actions/setup-java@v4
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         java-version: ${{matrix.java}}
         distribution: temurin
@@ -331,8 +346,10 @@ jobs:
       matrix:
         package: ${{ fromJSON(needs.changes.outputs.packages) }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         distribution: temurin
         java-version: 11
@@ -348,8 +365,10 @@ jobs:
       matrix:
         package: ${{ fromJSON(needs.changes.outputs.packages) }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         distribution: temurin
         java-version: 17
@@ -374,8 +393,10 @@ jobs:
     steps:
     - name: Support longpaths
       run: git config --system core.longpaths true
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         distribution: temurin
         java-version: 11
@@ -390,10 +411,11 @@ jobs:
     if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         fetch-depth: 0
-    - uses: actions/setup-java@v4
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         distribution: temurin
         java-version: 17
@@ -411,8 +433,10 @@ jobs:
     - name: Get current week within the year
       id: date
       run: echo "::set-output name=week_of_year::$(date +'%W' --utc)"
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         distribution: temurin
         java-version: 11
@@ -429,8 +453,10 @@ jobs:
     if: ${{ needs.bulk-filter.outputs.runnable == 'true' }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         java-version: 11
         distribution: temurin
@@ -440,7 +466,7 @@ jobs:
       env:
         JOB_TYPE: install
     - name: Validate gapic-libraries-bom
-      uses: googleapis/java-cloud-bom/tests/validate-bom@v26.79.0
+      uses: googleapis/java-cloud-bom/tests/validate-bom@377c8d1fac6b1521dc52a10f4d02e5d371a0de67 # v26.79.0
       with:
         bom-path: gapic-libraries-bom/pom.xml
 

.github/workflows/create_additional_release_tag.yaml

@@ -1,3 +1,6 @@
+permissions:
+  contents: read
+
 name: Create additional tags for each release
 
 on:
@@ -13,9 +16,10 @@ jobs:
       contents: write
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
       with:
         token: ${{ secrets.CLOUD_JAVA_BOT_GITHUB_TOKEN }}
+        persist-credentials: false
     - name: Set up Git
       run: |
         git config --local user.email "action@github.com"

.github/workflows/google-auth-library-java-ci.yaml

@@ -13,6 +13,9 @@
 # limitations under the License.
 # GitHub action job to test core java library features on
 # downstream client libraries before they are released.
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -27,7 +30,9 @@ jobs:
     outputs:
       library: ${{ steps.filter.outputs.library }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
     - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
@@ -44,8 +49,10 @@ jobs:
       matrix:
         java: [11, 17, 21, 25, 26]
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         distribution: temurin
         java-version: ${{matrix.java}}
@@ -60,8 +67,10 @@ jobs:
     if: ${{ needs.filter.outputs.library == 'true' }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-java@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
       with:
         distribution: temurin
         java-version: 11
@@ -75,8 +84,10 @@ jobs:
     if: ${{ needs.filter.outputs.library == 'true' }}
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
       with:
         distribution: temurin
         java-version: 17
@@ -92,4 +103,4 @@ jobs:
         if: ${{ contains(needs.*.result, 'failure') }}
         run: exit 1
       - name: Success otherwise
-        run: echo "Success!"
+        run: echo "Success!"