ci: add shared security scanning workflow

.github/actions/build-collector-layer/action.yml

@@ -24,7 +24,9 @@ runs:
 
     - name: Build collector layer
       shell: bash
-      run: make -C collector package GOARCH=${{ inputs.architecture }}
+      run: make -C collector package GOARCH="${INPUTS_ARCHITECTURE}"
+      env:
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Save collector version
       if: ${{ inputs.architecture == 'amd64' }}

.github/dependabot.yml

@@ -14,6 +14,8 @@ updates:
       - "/go/sample-apps/function"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       opentelemetry-deps-collector:
         patterns:
@@ -27,6 +29,8 @@ updates:
       - "/java"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       opentelemetry-deps-java:
         patterns:
@@ -42,6 +46,8 @@ updates:
       - "/nodejs/sample-apps/aws-sdk"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       opentelemetry-deps-nodejs:
         patterns:
@@ -58,6 +64,8 @@ updates:
       - "/python/src/otel/tests"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       opentelemetry-deps-python:
         patterns:
@@ -72,6 +80,8 @@ updates:
       - "/ruby/sample-apps/function"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       opentelemetry-deps-ruby:
         patterns:

.github/workflows/check-links.yaml

@@ -12,7 +12,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   changedfiles:
@@ -27,6 +28,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Get changed files
         id: changes
         run: |
@@ -46,6 +48,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Link Checker
         id: lychee

.github/workflows/ci-collector.yml

@@ -22,6 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: collector/go.mod
@@ -45,6 +47,8 @@ jobs:
         architecture: [ amd64, arm64 ]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: collector/go.mod
@@ -66,7 +70,7 @@ jobs:
       - name: Confirm architecture of built collector
         working-directory: collector/build/extensions
         run: |
-          grep ${{ env.LAMBDA_LAYER_ARCHITECTURE }} <<< "$(file collector)"
+          grep "${LAMBDA_LAYER_ARCHITECTURE}" <<< "$(file collector)"
       - name: Output artifact size to job summary
         working-directory: collector/build
         run: |

.github/workflows/ci-java.yml

@@ -24,6 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:

.github/workflows/ci-nodejs.yml

@@ -22,6 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: 'nodejs/.nvmrc'

.github/workflows/ci-python.yml

@@ -36,6 +36,8 @@ jobs:
     steps:
       - name: Checkout this repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Python for OTel Python SDK
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:

.github/workflows/ci-shellcheck.yml

@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install shell check
         run: sudo apt update && sudo apt install --assume-yes shellcheck

.github/workflows/ci-terraform.yml

@@ -22,5 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
       - run: terraform fmt -check -recursive

.github/workflows/codeql.yml

@@ -65,6 +65,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/fossa.yml

@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
         with:

.github/workflows/integration-test.yml

@@ -26,6 +26,9 @@ on:
         required: false
         default: false
         type: boolean
+    secrets:
+      INTEGRATION_TEST_ROLE_ARN:
+        required: true
 
 permissions:
   contents: read
@@ -39,12 +42,14 @@ jobs:
       - id: prepare-languages
         name: Prepare Languages
         run: |
-          if [ "${{ inputs.language }}" = "all" ]; then
+          if [ "${INPUTS_LANGUAGE}" = "all" ]; then
             languages='["nodejs", "python", "ruby", "javaagent", "javawrapper"]'
           else
-            languages='["${{ inputs.language }}"]'
+            languages="[\"${INPUTS_LANGUAGE}\"]"
           fi
           echo "languages=${languages}" >> "$GITHUB_OUTPUT"
+        env:
+          INPUTS_LANGUAGE: ${{ inputs.language }}
 
   build-collector:
     runs-on: ubuntu-latest
@@ -54,6 +59,8 @@ jobs:
         architecture: [amd64, arm64]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/build-collector-layer
         id: build
         with:
@@ -73,6 +80,8 @@ jobs:
         language: ${{ fromJson(needs.prepare-languages.outputs.languages) }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/build-layer
         id: build
         with:
@@ -99,6 +108,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:

.github/workflows/layer-publish.yml

@@ -40,6 +40,11 @@ on:
         description: '(optional) Layer version to be used in the layer name. If no input is given, its value is tried to be extracted from the `GITHUB_REF_NAME` variable'
         required: false
         type: string
+    secrets:
+      OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN:
+        required: false
+      PROD_LAMBDA_ROLE_ARN:
+        required: false
 
 permissions:
   contents: read
@@ -55,27 +60,27 @@ jobs:
       - name: Construct Layer Name
         shell: bash
         run: |
-          LAYER_NAME=${{ inputs.layer-name }}
+          LAYER_NAME="${INPUTS_LAYER_NAME}"
 
-          if [[ -n "${{ inputs.architecture }}" ]]; then
-            LAYER_NAME=$LAYER_NAME-${{ inputs.architecture }}
-            ARCH=$(echo "${{ inputs.architecture }}" | sed -r 's/amd64/x86_64/g')
+          if [[ -n "${INPUTS_ARCHITECTURE}" ]]; then
+            LAYER_NAME="${LAYER_NAME}-${INPUTS_ARCHITECTURE}"
+            ARCH=$(echo "${INPUTS_ARCHITECTURE}" | sed -r 's/amd64/x86_64/g')
           else
             ARCH="x86_64 arm64"
           fi
           echo "ARCH=$ARCH" >> $GITHUB_ENV
 
-          if [[ -n "${{ inputs.runtimes }}" ]]; then
-            COMPATIBLE_RUNTIMES="--compatible-runtimes ${{ inputs.runtimes }}"
+          if [[ -n "${INPUTS_RUNTIMES}" ]]; then
+            COMPATIBLE_RUNTIMES="--compatible-runtimes ${INPUTS_RUNTIMES}"
           fi
           echo "COMPATIBLE_RUNTIMES=$COMPATIBLE_RUNTIMES" >> $GITHUB_ENV
 
-          if [[ "${{ inputs.release-group }}" != "prod" ]]; then
-            LAYER_NAME=$LAYER_NAME-${{ inputs.release-group }}
+          if [[ "${INPUTS_RELEASE_GROUP}" != "prod" ]]; then
+            LAYER_NAME="${LAYER_NAME}-${INPUTS_RELEASE_GROUP}"
           fi
 
-          if [[ -n "${{ inputs.layer-version }}" ]]; then
-            LAYER_VERSION="${{ inputs.layer-version }}"
+          if [[ -n "${INPUTS_LAYER_VERSION}" ]]; then
+            LAYER_VERSION="${INPUTS_LAYER_VERSION}"
           else
             LAYER_VERSION=$(echo "$GITHUB_REF_NAME" | sed -r 's/.*\/[^0-9\.]*//g')
           fi
@@ -88,6 +93,12 @@ jobs:
 
           echo GITHUB_ENV:
           cat $GITHUB_ENV
+        env:
+          INPUTS_LAYER_NAME: ${{ inputs.layer-name }}
+          INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
+          INPUTS_RUNTIMES: ${{ inputs.runtimes }}
+          INPUTS_RELEASE_GROUP: ${{ inputs.release-group }}
+          INPUTS_LAYER_VERSION: ${{ inputs.layer-version }}
 
       - name: Download built layer
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -109,11 +120,14 @@ jobs:
               --license-info "Apache 2.0" \
               --compatible-architectures $ARCH \
               $COMPATIBLE_RUNTIMES \
-              --zip-file fileb://${{ inputs.artifact-name }} \
+              --zip-file "fileb://${INPUTS_ARTIFACT_NAME}" \
               --query 'LayerVersionArn' \
               --output text
           )
-          echo "::notice ::$LAYER_ARN component-version=${{ inputs.component-version }}"
+          echo "::notice ::$LAYER_ARN component-version=${INPUTS_COMPONENT_VERSION}"
+        env:
+          INPUTS_ARTIFACT_NAME: ${{ inputs.artifact-name }}
+          INPUTS_COMPONENT_VERSION: ${{ inputs.component-version }}
         # echo "* $LAYER_ARN" >> $GITHUB_STEP_SUMMARY
 
       - name: Make Layer Public

.github/workflows/pr-checks.yaml

@@ -3,6 +3,7 @@ name: Check PR
 on:
   workflow_dispatch:
   pull_request_target:
+    # zizmor: ignore[dangerous-triggers] Pinned actions run only trusted base-branch code; no pull request head code is loaded.
     types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
@@ -17,6 +18,8 @@ jobs:
       pull-requests: write # required for adding labels to pr
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"