From a59fa1d2a105deb6f98e7ab1c68402061a20bf70 Mon Sep 17 00:00:00 2001 From: Husam Date: Wed, 1 Jul 2026 01:40:29 +0000 Subject: [PATCH 1/4] chore(actions): address zizmor findings This PR is an auto-generated attempt to address zizmor findings. It may not catch everything, and should be reviewed by repository owners. If it is unhelpful, feel free to close the PR and address separately. This PR was generated by running `zizmor --fix=all --gh-token=$(gh auth token) ./.github/workflows`. See go/github-zizmor-help for instructions to install and run. If this PR is helpful, feel free to approve and merge, or edit/modify as needed to get it to the right state. Repository owners must ultimately ensure compliance by 2026-07-13. The purpose of this PR is to provide some assistance with achieving that as a first pass. This will become a blocking check for new changes to github workflows on 2026-07-13 within the `googleapis` org. There may be some ignored findings (with the comment `# zizmor: ignore[...]`), which you may fix if feasible. --- .github/workflows/bazel_example.yml | 10 +++++++--- .github/workflows/lint.yml | 3 +++ .github/workflows/phpunit.yml | 8 ++++++-- 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/.github/workflows/bazel_example.yml b/.github/workflows/bazel_example.yml index e565af2b5..e014d903e 100644 --- a/.github/workflows/bazel_example.yml +++ b/.github/workflows/bazel_example.yml @@ -1,3 +1,6 @@ +permissions: + contents: read + name: Bazel Build on: @@ -13,13 +16,14 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: submodules: 'recursive' + persist-credentials: false - name: Bazel File Cache Setup id: cache-bazel - uses: actions/cache@v6 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6 with: path: ~/.cache/bazel key: ${{ runner.os }}-bazel-20210105-${{ secrets.CACHE_VERSION }} @@ -81,7 +85,7 @@ jobs: tests/Integration:talent \ tests/Integration:videointelligence --noshow_progress --cache_test_results=no - - uses: actions/upload-artifact@v5 + - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5 if: ${{ failure() }} with: name: test-artifacts diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index e99e6a3b9..2dc26a2b1 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -1,3 +1,6 @@ +permissions: + contents: read + name: Lint on: diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml index 0a231b7ef..59186a8b3 100644 --- a/.github/workflows/phpunit.yml +++ b/.github/workflows/phpunit.yml @@ -1,3 +1,6 @@ +permissions: + contents: read + name: PhpUnit tests on: @@ -12,12 +15,13 @@ jobs: steps: - name: Checkout code - uses: actions/checkout@v7 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7 with: submodules: 'recursive' + persist-credentials: false - name: Install PHP - uses: shivammathur/setup-php@v2 + uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2 with: php-version: '8.2' From 46cb6e0c60fdcab63b923d10d863e06260214639 Mon Sep 17 00:00:00 2001 From: Husam Date: Wed, 1 Jul 2026 02:44:07 +0000 Subject: [PATCH 2/4] chore(renovate): replace config:base/recommended with best-practices --- renovate.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/renovate.json b/renovate.json index 14b84f202..4f2a8a1ab 100644 --- a/renovate.json +++ b/renovate.json @@ -1,6 +1,6 @@ { "extends": [ - "config:base", + "config:best-practices", ":disableDependencyDashboard", ":preserveSemverRanges" ], From c6aa5283ff24ae5a115c0557b0dce2da66a64aaf Mon Sep 17 00:00:00 2001 From: Husam Date: Wed, 1 Jul 2026 03:07:39 +0000 Subject: [PATCH 3/4] chore(actions): address zizmor unpinned findings --- .github/workflows/lint.yml | 4 ++-- .github/workflows/release-checks.yaml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index 2dc26a2b1..e5aab973e 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -14,12 +14,12 @@ on: jobs: style: name: PHP Style Check - uses: GoogleCloudPlatform/php-tools/.github/workflows/code-standards.yml@main + uses: GoogleCloudPlatform/php-tools/.github/workflows/code-standards.yml@main # zizmor: ignore[unpinned-uses] with: path: src static-analysis: name: PHPStan Static Analysis - uses: GoogleCloudPlatform/php-tools/.github/workflows/static-analysis.yml@main + uses: GoogleCloudPlatform/php-tools/.github/workflows/static-analysis.yml@main # zizmor: ignore[unpinned-uses] with: autoload-file: tests/Unit/autoload.php diff --git a/.github/workflows/release-checks.yaml b/.github/workflows/release-checks.yaml index e0375ffd5..c9b66c51d 100644 --- a/.github/workflows/release-checks.yaml +++ b/.github/workflows/release-checks.yaml @@ -8,7 +8,7 @@ permissions: jobs: next-release-label-check: name: Check for "next release" label - uses: GoogleCloudPlatform/php-tools/.github/workflows/release-checks.yml@main + uses: GoogleCloudPlatform/php-tools/.github/workflows/release-checks.yml@main # zizmor: ignore[unpinned-uses] if: github.event.pull_request.user.login == 'release-please[bot]' with: next-release-label-check: false From 3a7e6a5dcbbf6c5512d8f3aa0665c560bd8785be Mon Sep 17 00:00:00 2001 From: Husam Date: Wed, 1 Jul 2026 03:30:23 +0000 Subject: [PATCH 4/4] chore(actions): address zizmor security and container pinning findings --- .github/workflows/bazel_example.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/bazel_example.yml b/.github/workflows/bazel_example.yml index e014d903e..6a0a4b2a7 100644 --- a/.github/workflows/bazel_example.yml +++ b/.github/workflows/bazel_example.yml @@ -12,7 +12,7 @@ on: jobs: build: runs-on: ubuntu-24.04 - container: gcr.io/gapic-images/googleapis:latest + container: gcr.io/gapic-images/googleapis:latest # zizmor: ignore[unpinned-images] steps: - name: Checkout code