Adopt shared zizmor workflow (#528)

* Add shared zizmor workflow

* Fix blocking zizmor findings

* Add shared zizmor workflow

* Add trailing newline

* Clarify CodeQL release branch comment

* Document zizmor schedule

* Run zizmor on all pull requests

* Scan release branch pushes with zizmor

---------

Co-authored-by: Trask Stalnaker <trask.stalnaker@gmail.com>

Author: opentelemetrybot

.github/workflows/auto-update-semconv.yml

@@ -56,6 +56,8 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_SEMANTIC_CONVENTIONS_JAVA_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_SEMANTIC_CONVENTIONS_JAVA_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:

.github/workflows/codeql.yml

@@ -38,7 +38,8 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      - name: Set up gradle
+      # This workflow analyzes release branches but does not build or publish release artifacts.
+      - name: Set up gradle # zizmor: ignore[cache-poisoning]
         if: matrix.language == 'java'
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
 

.github/workflows/prepare-release-branch.yml

@@ -67,6 +67,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against the release branch
         env:
@@ -115,6 +116,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against main
         env:

.github/workflows/release.yml

@@ -202,6 +202,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against main
         env:

.github/workflows/zizmor.yml

@@ -0,0 +1,20 @@
+name: Zizmor
+
+on:
+  push:
+    branches:
+      - main
+      - release/*
+  pull_request:
+  schedule:
+    - cron: '53 6 * * 4' # weekly at 06:53 UTC on Thursday
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    permissions:
+      contents: read # for actions/checkout
+      security-events: write # for zizmor to upload SARIF results
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1