fix(ci): GitHub Actions security hardening - #703

Open

stevebeattie wants to merge 6 commits into

wolfi-dev:mainfrom

stevebeattie:security/psec-923-actions

Commits on Jul 2, 2026

fix(ci): move template expressions out of run blocks into env
stevebeattie
committed
fix(ci): set persist-credentials false on checkout steps
stevebeattie
committed
fix(ci): suppress cosmetic zizmor rules and set dependabot cooldown
stevebeattie
committed
fix(ci): pass optional gcloud ACL flag as an array (SC2086)
stevebeattie
committed
fix(ci): quote $TMP and $GITHUB_PATH in install-wolfictl (SC2086)
stevebeattie
committed
fix(ci): document benign github-env write in install-wolfictl (zizmor ignore)
stevebeattie
committed