From 56d02da79f0246bccb73c272b01e52facab6acc3 Mon Sep 17 00:00:00 2001
From: William French <dubnewt@gmail.com>
Date: Mon, 17 Aug 2026 09:54:28 -0700
Subject: [PATCH 01/12] fix(ci): resolve missing Rollup native binary during
 rollup builds

Change-Id: I6fe35002e760cf38c46a858c5f8159959e2e4337
---
 .github/workflows/tests.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index a4df0f53e..d78b78bd6 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -106,7 +106,9 @@ jobs:
 
       - name: Install dependencies
         if: env.HAS_CHANGES == 'true'
-        run: npm ci
+        run: |
+          npm ci --include=optional
+          npm rebuild rollup
 
       - name: Prettier Check (Changed Files Only)
         if: env.HAS_CHANGES == 'true'
@@ -214,7 +216,9 @@ jobs:
             ${{ runner.os }}-playwright- # Broader fallback
 
       - name: Install dependencies
-        run: npm ci
+        run: |
+          npm ci --include=optional
+          npm rebuild rollup
 
       - name: Build All Projects
         run: npm run build-all

From 4f0d295bfc214547259eb0fc7f7464b3e467543c Mon Sep 17 00:00:00 2001
From: William French <dubnewt@gmail.com>
Date: Mon, 17 Aug 2026 10:21:06 -0700
Subject: [PATCH 02/12] fix(ci): Update rollup dependencies and secure workflow

Change-Id: Ib0fd0eb403befb40c62a330ce523ced3b8bcbb61
---
 .github/workflows/tests.yml | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index d78b78bd6..49c6fafb4 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -49,7 +49,7 @@ jobs:
       (github.event_name == 'push' && !contains(github.event.head_commit.message, 'chore: update dist folder'))
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
           lfs: true
@@ -58,13 +58,17 @@ jobs:
         id: get_workspaces
         # For PRs, compare against the origin's version of the base branch.
         # For pushes, compare against the commit before the push.
+        env:
+          BASE_REF: ${{ github.event_name == 'pull_request' && format('origin/{0}', github.base_ref) || github.event.before }}
         run: |
-          bash samples/find-changes.sh ${{ github.event_name == 'pull_request' && format('origin/{0}', github.base_ref) || github.event.before }}
+          bash samples/find-changes.sh "$BASE_REF"
 
       - name: Check for changes
         id: check_changes
+        env:
+          CHANGED_WORKSPACES: ${{ steps.get_workspaces.outputs.changed_workspaces }}
         run: |
-          if [ "${{ steps.get_workspaces.outputs.changed_workspaces }}" != "" ]; then
+          if [ "$CHANGED_WORKSPACES" != "" ]; then
             echo "HAS_CHANGES=true" >> $GITHUB_ENV
           else
             echo "HAS_CHANGES=false" >> $GITHUB_ENV
@@ -72,13 +76,13 @@ jobs:
 
       - name: Setup Node.js
         if: env.HAS_CHANGES == 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24.18.0"
 
       - name: Cache npm dependencies
         if: env.HAS_CHANGES == 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -94,7 +98,7 @@ jobs:
       - name: Cache Playwright browsers
         id: playwright-cache
         if: env.HAS_CHANGES == 'true'
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.cache/ms-playwright # Default Playwright cache path
           key: ${{ runner.os }}-playwright-${{ steps.playwright-version.outputs.version }}-${{ hashFiles('playwright.config.ts') }}
@@ -170,7 +174,7 @@ jobs:
           GOOGLE_MAPS_API_KEY: "${{ secrets.JS_MAPS_DEV_KEY }}"
 
       - name: Upload Test Report Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: failure()
         with:
           name: Test Results
@@ -183,17 +187,17 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           lfs: true
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24.18.0"
 
       - name: Cache npm dependencies
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -207,7 +211,7 @@ jobs:
 
       - name: Cache Playwright browsers
         id: playwright-cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.cache/ms-playwright # Default Playwright cache path
           key: ${{ runner.os }}-playwright-${{ steps.playwright-version.outputs.version }}-${{ hashFiles('playwright.config.ts') }}
@@ -240,7 +244,7 @@ jobs:
           GOOGLE_MAPS_API_KEY: "${{ secrets.JS_MAPS_DEV_KEY }}"
 
       - name: Upload Test Report Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: failure()
         with:
           name: Test Results

From d7fd081b84363c44dc085f04bd36d99314c36881 Mon Sep 17 00:00:00 2001
From: William French <dubnewt@gmail.com>
Date: Mon, 17 Aug 2026 10:28:35 -0700
Subject: [PATCH 03/12] fix(ci): pin actions and secure templates across all
 workflows

Change-Id: Ic9620fe267b28574e46089c3047a0f781abc1ce5
---
 .github/workflows/dist-pr.yml |  2 +-
 .github/workflows/release.yml | 18 +++++++++++-------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/dist-pr.yml b/.github/workflows/dist-pr.yml
index 14e2ffff5..5efba8279 100644
--- a/.github/workflows/dist-pr.yml
+++ b/.github/workflows/dist-pr.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           token: ${{ secrets.GH_MERGE_TOKEN }}
           fetch-depth: 0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3cee65ba7..2de4c2350 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,7 +31,7 @@ jobs:
       GOOGLE_MAPS_API_KEY: "${{ secrets.JS_MAPS_PROD_KEY }}"
     steps:
       - name: Checkout main
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
           token: ${{ secrets.GH_MERGE_TOKEN }}
@@ -42,14 +42,14 @@ jobs:
           git config --global user.name 'googlemaps-bot'
           git config --global user.email 'googlemaps-bot@google.com'
 
-      - uses: actions/cache@v3
+      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-node
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24.18.0"
 
@@ -57,7 +57,9 @@ jobs:
 
       - name: Get Affected Workspaces
         id: get_workspaces
-        run: bash samples/find-changes.sh ${{ github.event.before }}
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+        run: bash samples/find-changes.sh "$BEFORE_SHA"
 
       - name: Build Affected Projects
         if: steps.get_workspaces.outputs.changed_workspaces != ''
@@ -81,7 +83,9 @@ jobs:
 
       - name: Get Deleted Workspaces
         id: get_deleted
-        run: bash samples/find-deleted-subfolders.sh ${{ github.event.before }}
+        env:
+          BEFORE_SHA: ${{ github.event.before }}
+        run: bash samples/find-deleted-subfolders.sh "$BEFORE_SHA"
 
       - name: Remove Output for Deleted Folders
         if: steps.get_deleted.outputs.deleted_workspaces != ''
@@ -97,7 +101,7 @@ jobs:
       - name: Generate Index
         run: bash samples/generate-index.sh
 
-      - uses: google-github-actions/auth@v1
+      - uses: google-github-actions/auth@955352c3b43196640b567e4646256d2fbb4aa1c7 # v1
         with:
           credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_KEY }}
 
@@ -127,7 +131,7 @@ jobs:
 
       - name: Trigger Create Release Workflow
         if: steps.commit_and_push.outputs.changes_pushed == 'true'
-        uses: benc-uk/workflow-dispatch@v1
+        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1
         with:
           workflow: dist-pr.yml
           ref: "main"

From b3dad88a47ff92476b036ef01e6e77c55b8118e4 Mon Sep 17 00:00:00 2001
From: William French <dubnewt@gmail.com>
Date: Mon, 17 Aug 2026 10:34:18 -0700
Subject: [PATCH 04/12] fix(ci): secure template expansions in dist-pr.yml

Change-Id: Ia9b6caac3e94072d96b549908854bcf012115a41
---
 .github/workflows/dist-pr.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/dist-pr.yml b/.github/workflows/dist-pr.yml
index 5efba8279..cff6afc47 100644
--- a/.github/workflows/dist-pr.yml
+++ b/.github/workflows/dist-pr.yml
@@ -82,11 +82,15 @@ jobs:
 
       - name: Determine PR URL
         id: pr
+        env:
+          PR_EXISTS: ${{ steps.find_pr.outputs.pr_exists }}
+          FIND_PR_URL: ${{ steps.find_pr.outputs.pr_url }}
+          CREATE_PR_URL: ${{ steps.create_pr.outputs.pr_url }}
         run: |
-          if [ "${{ steps.find_pr.outputs.pr_exists }}" = "true" ]; then
-            echo "pr_url=${{ steps.find_pr.outputs.pr_url }}" >> "$GITHUB_OUTPUT"
+          if [ "$PR_EXISTS" = "true" ]; then
+            echo "pr_url=$FIND_PR_URL" >> "$GITHUB_OUTPUT"
           else
-            echo "pr_url=${{ steps.create_pr.outputs.pr_url }}" >> "$GITHUB_OUTPUT"
+            echo "pr_url=$CREATE_PR_URL" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Approve PR

From cf68657fafa3c2765b67f113ee19de20a6b56b37 Mon Sep 17 00:00:00 2001
From: William French <dubnewt@gmail.com>
Date: Mon, 17 Aug 2026 10:40:54 -0700
Subject: [PATCH 05/12] fix(ci): secure dependabot condition

Change-Id: Ic5643840800c26096a01832906dde1b08844f9cc
---
 .github/workflows/dependabot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index b82619a65..c5d591b4d 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -22,7 +22,7 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: ${{ github.actor == 'dependabot[bot]' }}
+    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
     env:
       PR_URL: ${{ github.event.pull_request.html_url }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 6c980cd07580daf3dcf0891e9b74cfc45d351d8d Mon Sep 17 00:00:00 2001
From: William French <dubnewt@gmail.com>
Date: Mon, 17 Aug 2026 10:46:08 -0700
Subject: [PATCH 06/12] fix(ci): Adds ignores to false positive zizmor errors

Change-Id: I285bf64c83c9845370b10e015ed38a29ebe4ddc4
---
 .github/workflows/dependabot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index c5d591b4d..3ff4cf111 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -13,7 +13,7 @@
 # limitations under the License.
 
 name: Dependabot
-on: pull_request_target
+on: pull_request_target # zizmor: ignore[dangerous-triggers]
 
 permissions:
   contents: write

From 5abbbbf6de7a9bd6e139c7bf6b3bc2b717c80367 Mon Sep 17 00:00:00 2001
From: William French <dubnewt@gmail.com>
Date: Mon, 17 Aug 2026 10:51:22 -0700
Subject: [PATCH 07/12] fix(ci): fix unsound trailing newlines in multiline if
 conditions

Change-Id: Ia16464f401d50a7ab5b90b700e6bb3acfc602b77
---
 .github/workflows/dependabot.yml | 2 +-
 .github/workflows/tests.yml      | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index 3ff4cf111..b9ed7e7d0 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -22,7 +22,7 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: ${{ github.event.pull_request.user.login == 'dependabot[bot]' }}
+    if: github.actor == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
     env:
       PR_URL: ${{ github.event.pull_request.html_url }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 49c6fafb4..f617c5893 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -44,7 +44,7 @@ concurrency:
 jobs:
   pr_and_push_tests:
     name: Playwright PR/Push Tests
-    if: |
+    if: |-
       (github.event_name == 'pull_request' && github.event.pull_request.merged == false) ||
       (github.event_name == 'push' && !contains(github.event.head_commit.message, 'chore: update dist folder'))
     runs-on: ubuntu-latest
@@ -160,7 +160,7 @@ jobs:
 
       - name: Generate Index (Run Once After Builds)
         run: bash samples/generate-index.sh
-        if: |
+        if: |-
           env.HAS_CHANGES == 'true' ||
           contains(github.event.pull_request.paths.*, 'samples/generate-index.sh')
 

From 8ccde62bc57f26e258f4397b35b025494e1009df Mon Sep 17 00:00:00 2001
From: William French <dubnewt@gmail.com>
Date: Mon, 17 Aug 2026 10:57:43 -0700
Subject: [PATCH 08/12] fix(ci): suppress false positive bot-conditions check

Change-Id: Id4a97ce9de53cc8dcd5161309535189a701fc066
---
 .github/workflows/dependabot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index b9ed7e7d0..49d855f18 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -22,7 +22,7 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name
+    if: github.actor == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name # zizmor: ignore[bot-conditions]
     env:
       PR_URL: ${{ github.event.pull_request.html_url }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From 541a6359d373e6fae5a23374d9e472a72099aeb4 Mon Sep 17 00:00:00 2001
From: William French <dubnewt@gmail.com>
Date: Mon, 17 Aug 2026 11:01:46 -0700
Subject: [PATCH 09/12] fix(ci): replace github.actor with user.login for
 dependabot

Change-Id: Icf73e51cdad502a86770e2a42b5edafdab85c853
---
 .github/workflows/dependabot.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index 49d855f18..dbdade3fd 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -22,7 +22,7 @@ permissions:
 jobs:
   dependabot:
     runs-on: ubuntu-latest
-    if: github.actor == 'dependabot[bot]' && github.repository == github.event.pull_request.head.repo.full_name # zizmor: ignore[bot-conditions]
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
     env:
       PR_URL: ${{ github.event.pull_request.html_url }}
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From a489c88ecbab7b0acc6cbca95375659ac9d60b07 Mon Sep 17 00:00:00 2001
From: William French <dubnewt@gmail.com>
Date: Mon, 17 Aug 2026 11:19:42 -0700
Subject: [PATCH 10/12] fix(ci): fix excessive-permissions and artipacked
 warnings

Change-Id: I3bd2a13d609d13a4a7be074e21b5b5886cc1ab23
---
 .github/workflows/dist-pr.yml | 2 +-
 .github/workflows/release.yml | 6 +++---
 .github/workflows/tests.yml   | 8 ++++++--
 3 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/dist-pr.yml b/.github/workflows/dist-pr.yml
index cff6afc47..77911b211 100644
--- a/.github/workflows/dist-pr.yml
+++ b/.github/workflows/dist-pr.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           token: ${{ secrets.GH_MERGE_TOKEN }}
           fetch-depth: 0
-
+          persist-credentials: false
       - name: Set Git Identity
         run: |
           git config --global user.name 'googlemaps-bot'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2de4c2350..828b6cfb4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,8 +30,8 @@ jobs:
     env:
       GOOGLE_MAPS_API_KEY: "${{ secrets.JS_MAPS_PROD_KEY }}"
     steps:
-      - name: Checkout main
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - name: Checkout main # zizmor: ignore[artipacked]
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 zizmor: ignore[artipacked]
         with:
           ref: main
           token: ${{ secrets.GH_MERGE_TOKEN }}
@@ -106,7 +106,7 @@ jobs:
           credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_KEY }}
 
       - name: Install Firebase CLI
-        run: npm install -g firebase-tools
+        run: npm install -g firebase-tools # zizmor: ignore[adhoc-packages]
 
       - name: Deploy to Firebase Hosting
         run: firebase deploy --only hosting
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index f617c5893..eaaafeefa 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -14,6 +14,9 @@
 
 name: Tests
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     types: [opened, synchronize, edited]
@@ -52,8 +55,9 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
+          persist-credentials: false
           lfs: true
-
+          persist-credentials: false
       - name: Get Changed Workspaces
         id: get_workspaces
         # For PRs, compare against the origin's version of the base branch.
@@ -190,7 +194,7 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           lfs: true
-
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:

From 220f5fb15a822d29e7eff7d5527b6b3c2c09b76c Mon Sep 17 00:00:00 2001
From: William French <dubnewt@gmail.com>
Date: Mon, 17 Aug 2026 11:37:00 -0700
Subject: [PATCH 11/12] fix(ci): suppress dependabot-cooldown and fix release
 artipacked

Change-Id: Ib283157318432a60a4c18a04972b0e723654dc8b
---
 .github/dependabot.yml        |  2 +-
 .github/workflows/release.yml | 12 +++++++-----
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bff08b2b5..67643ddfb 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -14,7 +14,7 @@
 
 version: 2
 updates:
-  - package-ecosystem: "npm"
+  - package-ecosystem: "npm" # zizmor: ignore[dependabot-cooldown]
     directory: "/"
     schedule:
       interval: "weekly"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 828b6cfb4..0c6a24a24 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,7 +31,7 @@ jobs:
       GOOGLE_MAPS_API_KEY: "${{ secrets.JS_MAPS_PROD_KEY }}"
     steps:
       - name: Checkout main # zizmor: ignore[artipacked]
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4 zizmor: ignore[artipacked]
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: main
           token: ${{ secrets.GH_MERGE_TOKEN }}
@@ -42,7 +42,7 @@ jobs:
           git config --global user.name 'googlemaps-bot'
           git config --global user.email 'googlemaps-bot@google.com'
 
-      - uses: actions/cache@6f8efc29b200d32929f49075959781ed54ec270c # v3
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -89,9 +89,11 @@ jobs:
 
       - name: Remove Output for Deleted Folders
         if: steps.get_deleted.outputs.deleted_workspaces != ''
+        env:
+          DELETED_WORKSPACES: ${{ steps.get_deleted.outputs.deleted_workspaces }}
         run: |
           IFS=$'\n'
-          DELETED_WORKSPACES_ARRAY=({{ steps.get_deleted.outputs.deleted_workspaces }})
+          DELETED_WORKSPACES_ARRAY=(${DELETED_WORKSPACES})
           echo "Removing deleted project output:"
           for workspace in "${DELETED_WORKSPACES_ARRAY[@]}"; do
             echo "  - samples/$workspace"
@@ -101,7 +103,7 @@ jobs:
       - name: Generate Index
         run: bash samples/generate-index.sh
 
-      - uses: google-github-actions/auth@955352c3b43196640b567e4646256d2fbb4aa1c7 # v1
+      - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2
         with:
           credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_KEY }}
 
@@ -131,7 +133,7 @@ jobs:
 
       - name: Trigger Create Release Workflow
         if: steps.commit_and_push.outputs.changes_pushed == 'true'
-        uses: benc-uk/workflow-dispatch@31e2b3319479a63f0ab15bf800eff9e913504e26 # v1
+        uses: benc-uk/workflow-dispatch@e2e5e9a103e331dad343f381a29e654aea3cf8fc # v1.2.4
         with:
           workflow: dist-pr.yml
           ref: "main"

From 839e353ed6ab2fa0b44366cb8915ed3035dfbbda Mon Sep 17 00:00:00 2001
From: Dale Hawkins <107309+dkhawk@users.noreply.github.com>
Date: Mon, 17 Aug 2026 14:35:26 -0600
Subject: [PATCH 12/12] fix(ci): justify zizmor suppressions and remove
 duplicate key in tests workflow

---
 .github/dependabot.yml           | 1 +
 .github/workflows/dependabot.yml | 2 ++
 .github/workflows/release.yml    | 2 ++
 .github/workflows/tests.yml      | 1 -
 4 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 67643ddfb..e48b1a50d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -14,6 +14,7 @@
 
 version: 2
 updates:
+  # Maintain weekly dependency update schedule without an artificial cooldown delay
   - package-ecosystem: "npm" # zizmor: ignore[dependabot-cooldown]
     directory: "/"
     schedule:
diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index dbdade3fd..f58d568af 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -13,6 +13,8 @@
 # limitations under the License.
 
 name: Dependabot
+# Safe: Workflow only interacts with the GitHub API via `gh` CLI to approve and auto-merge
+# verified Dependabot PRs; it does NOT checkout repository code or execute untrusted scripts.
 on: pull_request_target # zizmor: ignore[dangerous-triggers]
 
 permissions:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0c6a24a24..6d4ad07f6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,6 +30,7 @@ jobs:
     env:
       GOOGLE_MAPS_API_KEY: "${{ secrets.JS_MAPS_PROD_KEY }}"
     steps:
+      # Credentials must persist in local git config so subsequent steps can push to origin temp-build-branch
       - name: Checkout main # zizmor: ignore[artipacked]
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
@@ -107,6 +108,7 @@ jobs:
         with:
           credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_KEY }}
 
+      # Global CLI install needed on the runner for the subsequent firebase deploy step
       - name: Install Firebase CLI
         run: npm install -g firebase-tools # zizmor: ignore[adhoc-packages]
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index eaaafeefa..f0b88f962 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -57,7 +57,6 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
           lfs: true
-          persist-credentials: false
       - name: Get Changed Workspaces
         id: get_workspaces
         # For PRs, compare against the origin's version of the base branch.