From c7aee3edef2d12a622e06abdefe8cbea9fd03018 Mon Sep 17 00:00:00 2001 From: Husam Date: Wed, 1 Jul 2026 01:40:45 +0000 Subject: [PATCH 1/2] chore(actions): address zizmor findings This PR is an auto-generated attempt to address zizmor findings. It may not catch everything, and should be reviewed by repository owners. If it is unhelpful, feel free to close the PR and address separately. This PR was generated by running `zizmor --fix=all --gh-token=$(gh auth token) ./.github/workflows`. See go/github-zizmor-help for instructions to install and run. If this PR is helpful, feel free to approve and merge, or edit/modify as needed to get it to the right state. Repository owners must ultimately ensure compliance by 2026-07-13. The purpose of this PR is to provide some assistance with achieving that as a first pass. This will become a blocking check for new changes to github workflows on 2026-07-13 within the `googleapis` org. There may be some ignored findings (with the comment `# zizmor: ignore[...]`), which you may fix if feasible. --- .github/workflows/ci.yaml | 27 ++++++++++++++++++-------- .github/workflows/issues-no-repro.yaml | 11 ++++++++--- .github/workflows/response.yaml | 15 ++++++++++---- .github/workflows/update-apis.yaml | 5 ++++- 4 files changed, 42 insertions(+), 16 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 76f594db6c6..f16e585f8a1 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1,3 +1,6 @@ +permissions: + contents: read + on: push: branches: @@ -12,8 +15,10 @@ jobs: matrix: node: [18, 20, 22] steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - - uses: actions/setup-node@v6 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: ${{ matrix.node }} - run: node --version @@ -30,8 +35,10 @@ jobs: windows: runs-on: windows-latest steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - - uses: actions/setup-node@v6 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 22 - run: npm install @@ -41,8 +48,10 @@ jobs: lint: runs-on: ubuntu-latest steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - - uses: actions/setup-node@v6 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 22 - run: npm install @@ -50,8 +59,10 @@ jobs: docs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5 - - uses: actions/setup-node@v6 + - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + with: + persist-credentials: false + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 22 - run: npm install diff --git a/.github/workflows/issues-no-repro.yaml b/.github/workflows/issues-no-repro.yaml index 978863915b1..9e24b7db826 100644 --- a/.github/workflows/issues-no-repro.yaml +++ b/.github/workflows/issues-no-repro.yaml @@ -1,3 +1,6 @@ +permissions: + contents: read + name: invalid_link on: issues: @@ -10,13 +13,15 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/checkout@v5 - - uses: actions/setup-node@v6 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + with: + persist-credentials: false + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 18 - run: npm install working-directory: ./.github/scripts - - uses: actions/github-script@v8 + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8 with: script: | const script = require('./.github/scripts/close-invalid-link.cjs') diff --git a/.github/workflows/response.yaml b/.github/workflows/response.yaml index e81a3603af5..f20ee42db2f 100644 --- a/.github/workflows/response.yaml +++ b/.github/workflows/response.yaml @@ -1,3 +1,6 @@ +permissions: + contents: read + name: no_response on: schedule: @@ -13,8 +16,10 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/checkout@v5 - - uses: actions/github-script@v7 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + with: + persist-credentials: false + - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: script: | const script = require('./.github/scripts/close-unresponsive.cjs') @@ -27,8 +32,10 @@ jobs: issues: write pull-requests: write steps: - - uses: actions/checkout@v5 - - uses: actions/github-script@v7 + - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5 + with: + persist-credentials: false + - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7 with: script: | const script = require('./.github/scripts/remove-response-label.cjs') diff --git a/.github/workflows/update-apis.yaml b/.github/workflows/update-apis.yaml index 8da90517e1d..69fd2704c0e 100644 --- a/.github/workflows/update-apis.yaml +++ b/.github/workflows/update-apis.yaml @@ -1,3 +1,6 @@ +permissions: + contents: read + on: schedule: - cron: "0 1 * * *" @@ -7,7 +10,7 @@ jobs: update-apis: runs-on: ubuntu-latest steps: - - uses: actions/setup-node@v6 + - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6 with: node-version: 22 - run: gh repo fork googleapis/google-api-nodejs-client --fork-name google-api-nodejs-client-autodisco --clone From f765d4f4e47b1b63cc40a7e0a0f5d2b5a9d673ed Mon Sep 17 00:00:00 2001 From: Husam Date: Wed, 1 Jul 2026 02:44:13 +0000 Subject: [PATCH 2/2] chore(renovate): replace config:base/recommended with best-practices --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index f39fd323231..08cca7c43be 100644 --- a/renovate.json +++ b/renovate.json @@ -1,6 +1,6 @@ { "extends": [ - "config:base", + "config:best-practices", "docker:disable", ":disableDependencyDashboard" ],