fix: address zizmor security audit findings with auto-fix in GitHub workflows

[hemasekhar-p]

Overview

This PR addresses security findings identified by zizmor static analysis in GitHub Actions workflows.

---

🛡️ What Was Changed and Why?

1. Pinned GitHub Actions to Full Commit SHAs (unpinned-uses)

• What changed: Replaced mutable version tags (e.g., @v4, @v8, @v10, @v3.0.2) with immutable 40-character commit hashes for external actions across all workflows (actions/checkout, actions/setup-java, actions/stale, actions/github-script, and MathieuSoysal/Javadoc-publisher.yml), preserving version tags as comments.
• Why: Version tags in Git are mutable and can be modified or compromised upstream. Pinning to an exact commit SHA guarantees that workflows execute verified, tamper-proof code and protects against supply-chain attacks.

2. Restricted Credential Persistence (artipacked)

• What changed: Configured persist-credentials: false on actions/checkout across workflow jobs (unit-tests.yml, pre-release-tests.yml, and publish-javadoc.yml).
• Why: By default, actions/checkout persists runner GITHUB_TOKEN credentials in the local .git/config. Disabling credential persistence prevents token exfiltration or artifact poisoning if build scripts or downstream dependencies are compromised.

---

📊 Modified Files Summary

File	Changes Made	Purpose
.github/workflows/unit-tests.yml	Pinned checkout & setup-java SHAs + persist-credentials: false	Prevent action tampering & credential persistence during unit tests
.github/workflows/pre-release-tests.yml	Pinned checkout & setup-java SHAs + persist-credentials: false	Secure pre-release test execution
.github/workflows/publish-javadoc.yml	Pinned checkout, setup-java, & Javadoc-publisher SHAs + persist-credentials: false	Secure JavaDoc publication pipeline
.github/workflows/stale.yml	Pinned actions/stale to exact commit SHA	Lock down automated stale issue/PR bot
.github/workflows/google-contributor-stale.yml	Pinned actions/stale to exact commit SHA	Lock down contributor stale bot
.github/workflows/block_major_releases.yml	Pinned actions/github-script to exact commit SHA	Secure major release guard workflow

---

📈 Zizmor Audit Results Comparison

• Before Fix: 36 findings (10 High, 5 Medium, 21 Suppressed)
• After Fix: 23 findings (0 High, 2 Medium, 21 Suppressed)
• Summary: Successfully resolved all 10 High-severity unpinned-uses findings and Low-severity artipacked credential persistence issues across 6 workflow files.

---

✅ Verification & Safety

• No runtime logic changes: No Java source code, build dependencies, or public API surfaces were modified.
• Exact version match: Pinned commit SHAs correspond directly to the official release versions already in use.
• CI continuity: All existing pipeline triggers, unit tests, and release steps continue to function normally.

[hemasekhar-p]

🔧 Manual Fix: Addressed Remaining excessive-permissions Findings

What was updated:

Added explicit permissions: contents: read to enforce least-privilege access in:

• .github/workflows/unit-tests.yml
• .github/workflows/pre-release-tests.yml

Reasoning:

Both workflows only perform build and test tasks that need read access to repository source code. Restricting the GITHUB_TOKEN to contents: read prevents workflows from inheriting broad default write permissions.

Audit Result:

Running zizmor after these manual fixes resolves the remaining Medium-severity findings:

• Before: 2 Medium findings (excessive-permissions)
• After: 0 High, 0 Medium findings (All mandatory & enforced checks passing)