chore: workflow hardening — pinact + zizmor [automated]

[infra-hardening]

Automated workflow hardening

This PR was generated by the pt-infra-hardening pipeline.

Changes

.github/workflows/cd-pipeline.yml — zizmor

• Added persist-credentials: false to checkout in get-chart job (line 25)
• Added persist-credentials: false to checkout in vib-publish job (line 75)

.github/workflows/ci-pipeline.yml — zizmor

• Added persist-credentials: false to checkout in look-for-hardcoded-images job (line 99)
• Added persist-credentials: false to upstream checkout in update-pr job (line 183)
• Added persist-credentials: false to checkout in chart-score job (line 486)
• Added persist-credentials: false to checkout in vib-verify job (line 562)

.github/workflows/index-monitor.yml — zizmor

• Added persist-credentials: false to checkout in integrity-check job (line 21)

.github/workflows/index-update.yml — zizmor

• Added persist-credentials: false to checkout in find-new-releases job (line 17)

.github/workflows/license-headers.yml — zizmor

• Added persist-credentials: false to checkout in the license-headers job (line 22)

.github/workflows/markdown-linter.yml — zizmor

• Added persist-credentials: false to checkout in the markdown-lint job (line 22)

.github/workflows/push-tag.yml — zizmor

• Added persist-credentials: false to checkout in get-chart job (line 25)
• Added persist-credentials: false to checkout in push-tag job (line 72)

.github/workflows/values-ascii-check.yml — zizmor

• Added persist-credentials: false to checkout in the values-ascii-check job (line 19)

⚠️ Needs human attention

These findings could not be fixed automatically and need a maintainer's decision:

• .github/workflows/cd-pipeline.yml:104 — artipacked: The actions/checkout step uses token: ${{ secrets.BITNAMI_BOT_TOKEN }} and an inline comment explicitly states "The token is persisted in the local git config and enables scripts to run authenticated git commands." Setting persist-credentials: false would break downstream authenticated git operations; a safe alternative (e.g., explicit git remote set-url with the token) is needed. → https://docs.zizmor.sh/audits/#artipacked

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/cd-pipeline.yml:

  # zizmor: ignore[artipacked] <your reason here>

• .github/workflows/ci-pipeline.yml:176 — artipacked: The actions/checkout step uses token: ${{ secrets.BITNAMI_BOT_TOKEN }} and the job (update-pr) subsequently runs git push to the PR branch using those persisted credentials. Setting persist-credentials: false would break the automated README/CHANGELOG push; a safe alternative is needed. → https://docs.zizmor.sh/audits/#artipacked

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/ci-pipeline.yml:

  # zizmor: ignore[artipacked] <your reason here>

• .github/workflows/index-update.yml:63 — artipacked: The actions/checkout step uses token: ${{ secrets.BITNAMI_BOT_TOKEN }} and an inline comment explicitly states "The token is persisted in the local git config and enables scripts to run authenticated git commands." Setting persist-credentials: false would break downstream authenticated git operations; a safe alternative is needed. → https://docs.zizmor.sh/audits/#artipacked

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/index-update.yml:

  # zizmor: ignore[artipacked] <your reason here>

• .github/workflows/assign-asset-label.yml:5 — dangerous-triggers: pull_request_target trigger grants write permissions to untrusted code from forks. Review whether this trigger is strictly necessary and ensure no untrusted input is used in privileged steps. → https://docs.zizmor.sh/audits/#dangerous-triggers

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/assign-asset-label.yml:

  # zizmor: ignore[dangerous-triggers] <your reason here>

• .github/workflows/ci-pipeline.yml:5 — dangerous-triggers: pull_request_target trigger grants write permissions to untrusted code from forks. Review whether this trigger is strictly necessary and ensure no untrusted input is used in privileged steps. → https://docs.zizmor.sh/audits/#dangerous-triggers

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/ci-pipeline.yml:

  # zizmor: ignore[dangerous-triggers] <your reason here>

• .github/workflows/license-headers.yml:5 — dangerous-triggers: pull_request_target trigger grants write permissions to untrusted code from forks. Review whether this trigger is strictly necessary and ensure no untrusted input is used in privileged steps. → https://docs.zizmor.sh/audits/#dangerous-triggers

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/license-headers.yml:

  # zizmor: ignore[dangerous-triggers] <your reason here>

• .github/workflows/move-closed-issues.yml:6 — dangerous-triggers: pull_request_target trigger grants write permissions to untrusted code from forks. Review whether this trigger is strictly necessary and ensure no untrusted input is used in privileged steps. → https://docs.zizmor.sh/audits/#dangerous-triggers

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/move-closed-issues.yml:

  # zizmor: ignore[dangerous-triggers] <your reason here>

• .github/workflows/pr-review-hack.yml:8 — dangerous-triggers: workflow_run trigger runs in the context of the base branch with full write access regardless of the triggering workflow's origin. Review whether untrusted inputs from the triggering workflow run are used in privileged steps. → https://docs.zizmor.sh/audits/#dangerous-triggers

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/pr-review-hack.yml:

  # zizmor: ignore[dangerous-triggers] <your reason here>

• .github/workflows/pr-reviews-requested.yml:6 — dangerous-triggers: pull_request_target trigger grants write permissions to untrusted code from forks. Review whether this trigger is strictly necessary and ensure no untrusted input is used in privileged steps. → https://docs.zizmor.sh/audits/#dangerous-triggers

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/pr-reviews-requested.yml:

  # zizmor: ignore[dangerous-triggers] <your reason here>

• .github/workflows/reasign.yml:6 — dangerous-triggers: pull_request_target trigger grants write permissions to untrusted code from forks. Review whether this trigger is strictly necessary and ensure no untrusted input is used in privileged steps. → https://docs.zizmor.sh/audits/#dangerous-triggers

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/reasign.yml:

  # zizmor: ignore[dangerous-triggers] <your reason here>

• .github/workflows/triage.yml:7 — dangerous-triggers: pull_request_target trigger grants write permissions to untrusted code from forks. Review whether this trigger is strictly necessary and ensure no untrusted input is used in privileged steps. → https://docs.zizmor.sh/audits/#dangerous-triggers

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/triage.yml:

  # zizmor: ignore[dangerous-triggers] <your reason here>

• .github/workflows/comments.yml:20 — secrets-inherit: A called reusable workflow unconditionally inherits all secrets via secrets: inherit, exposing every repository secret to the callee. Pass only the specific secrets the called workflow needs. → https://docs.zizmor.sh/audits/#secrets-inherit

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/comments.yml:

  # zizmor: ignore[secrets-inherit] <your reason here>

• .github/workflows/index-monitor.yml:110 — secrets-inherit: A called reusable workflow unconditionally inherits all secrets via secrets: inherit, exposing every repository secret to the callee. Pass only the specific secrets the called workflow needs. → https://docs.zizmor.sh/audits/#secrets-inherit

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/index-monitor.yml:

  # zizmor: ignore[secrets-inherit] <your reason here>

• .github/workflows/move-closed-issues.yml:22 — secrets-inherit: A called reusable workflow unconditionally inherits all secrets via secrets: inherit, exposing every repository secret to the callee. Pass only the specific secrets the called workflow needs. → https://docs.zizmor.sh/audits/#secrets-inherit

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/move-closed-issues.yml:

  # zizmor: ignore[secrets-inherit] <your reason here>

• .github/workflows/pr-review-hack.yml:53 — secrets-inherit: A called reusable workflow unconditionally inherits all secrets via secrets: inherit, exposing every repository secret to the callee. Pass only the specific secrets the called workflow needs. → https://docs.zizmor.sh/audits/#secrets-inherit

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/pr-review-hack.yml:

  # zizmor: ignore[secrets-inherit] <your reason here>

• .github/workflows/pr-reviews-requested.yml:19 — secrets-inherit: A called reusable workflow unconditionally inherits all secrets via secrets: inherit, exposing every repository secret to the callee. Pass only the specific secrets the called workflow needs. → https://docs.zizmor.sh/audits/#secrets-inherit

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/pr-reviews-requested.yml:

  # zizmor: ignore[secrets-inherit] <your reason here>

• .github/workflows/reasign.yml:23 — secrets-inherit: A called reusable workflow unconditionally inherits all secrets via secrets: inherit, exposing every repository secret to the callee. Pass only the specific secrets the called workflow needs. → https://docs.zizmor.sh/audits/#secrets-inherit

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/reasign.yml:

  # zizmor: ignore[secrets-inherit] <your reason here>

• .github/workflows/triage.yml:26 — secrets-inherit: A called reusable workflow unconditionally inherits all secrets via secrets: inherit, exposing every repository secret to the callee. Pass only the specific secrets the called workflow needs. → https://docs.zizmor.sh/audits/#secrets-inherit

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/triage.yml:

  # zizmor: ignore[secrets-inherit] <your reason here>

• .github/workflows/ci-pipeline.yml:511 — superfluous-actions: The addnab/docker-run-action step runs a Docker container, which the runner can do natively via docker run in a run: step or a container step — using a third-party action for this adds unnecessary supply-chain risk. Migrate to a native run: docker run ... step. → https://docs.zizmor.sh/audits/#superfluous-actions

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/ci-pipeline.yml:

  # zizmor: ignore[superfluous-actions] <your reason here>

---

Suppressing findings

To prevent a finding from being flagged in future hardening runs — whether it was fixed automatically or flagged for manual review — add an inline comment on the relevant line:

# zizmor: ignore[<rule-name>] <your reason here>

Replace <rule-name> with the audit name (e.g. artipacked, secrets-inherit). See zizmor audit docs for all rule names.