ci: zizmor autofix on github workflows

.github/workflows/cloudflare_sync.yaml

@@ -35,6 +35,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           ref: 'cloudflare-pages'
+          persist-credentials: false
       - name: Cleanup
         run: |
           rm -rf .git

.github/workflows/conformance.yml

@@ -56,9 +56,10 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           token: ${{ secrets.GITHUB_TOKEN }}
+          persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: 'go.mod'
 

.github/workflows/deploy_dev_docs_to_cf.yaml

@@ -45,6 +45,7 @@ jobs:
         with:
           fetch-depth: 0
           submodules: recursive
+          persist-credentials: false
 
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3
@@ -58,7 +59,7 @@ jobs:
           node-version: "22"
 
       - name: Cache dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}

.github/workflows/deploy_previous_version_docs_to_cf.yaml

@@ -35,6 +35,7 @@ jobs:
           ref: 'main'
           submodules: 'recursive'
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Checkout old content from tag into a temporary directory
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@@ -43,6 +44,7 @@ jobs:
           path: 'old_version_source'
           sparse-checkout: |
             docs
+          persist-credentials: false
 
       - name: Replace content with old version
         run: |

.github/workflows/deploy_versioned_docs_to_cf.yaml

@@ -33,6 +33,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           ref: ${{ github.event.release.tag_name }}
+          persist-credentials: false
 
       - name: Get Version from Release Tag
         id: get_version

.github/workflows/docs_lint.yaml

@@ -33,9 +33,11 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.x'
 
@@ -57,4 +59,4 @@ jobs:
         run: bash .ci/lint-docs-tool-page.sh
 
       - name: Run Sample Filters Linter
-        run: bash .ci/lint-docs-sample-filters.sh
+        run: bash .ci/lint-docs-sample-filters.sh

.github/workflows/docs_preview_build_cf.yaml

@@ -43,6 +43,7 @@ jobs:
         with:
           ref: ${{ env.HEAD_SHA }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Hugo
         uses: peaceiris/actions-hugo@2752ce1d29631191ea3f27c23495fa06139a5b78 # v3
@@ -71,7 +72,7 @@ jobs:
         run: |
           mkdir -p ../artifact-payload
           cp -r public ../artifact-payload/public
-          echo ${{ env.PR_NUMBER }} > ../artifact-payload/pr_number.txt
+          echo ${PR_NUMBER} > ../artifact-payload/pr_number.txt
 
       - name: Upload Artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
@@ -82,13 +83,15 @@ jobs:
 
       - name: Deployment Link
         run: |
-          DEPLOY_URL="https://github.com/${{ github.repository_owner }}/${{ github.event.repository.name }}/actions/workflows/docs_deploy_cf.yaml"
+          DEPLOY_URL="https://github.com/${{ github.repository_owner }}/${GITHUB_EVENT_REPOSITORY_NAME}/actions/workflows/docs_deploy_cf.yaml"
 
           echo "### Build Complete" >> $GITHUB_STEP_SUMMARY
-          echo "The build for PR #${{ env.PR_NUMBER }} succeeded." >> $GITHUB_STEP_SUMMARY
+          echo "The build for PR #${PR_NUMBER} succeeded." >> $GITHUB_STEP_SUMMARY
           echo "The Cloudflare deployment workflow is now starting." >> $GITHUB_STEP_SUMMARY
           echo "---" >> $GITHUB_STEP_SUMMARY
           echo "#### [Track Deployment Progress]($DEPLOY_URL)" >> $GITHUB_STEP_SUMMARY
+        env:
+          GITHUB_EVENT_REPOSITORY_NAME: ${{ github.event.repository.name }}
 
   remove-label:
     needs: build-preview

.github/workflows/docs_preview_deploy_cf.yaml

@@ -46,6 +46,8 @@ jobs:
     steps:
       - name: Checkout base repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Download Artifact
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
@@ -58,8 +60,8 @@ jobs:
       - name: Read PR Number
         id: get_pr
         run: |
-          if [ -n "${{ github.event.inputs.pr_number }}" ]; then
-            PR_NUMBER="${{ github.event.inputs.pr_number }}"
+          if [ -n "${GITHUB_EVENT_INPUTS_PR_NUMBER}" ]; then
+            PR_NUMBER="${GITHUB_EVENT_INPUTS_PR_NUMBER}"
           else
             PR_NUMBER=$(cat downloaded-artifact/pr_number.txt)
           fi
@@ -68,6 +70,8 @@ jobs:
             exit 1
           fi
           echo "pr_number=$PR_NUMBER" >> "$GITHUB_OUTPUT"
+        env:
+          GITHUB_EVENT_INPUTS_PR_NUMBER: ${{ github.event.inputs.pr_number }}
 
       - name: Deploy to Cloudflare Pages
         id: cf_deploy

.github/workflows/link_checker.yaml

@@ -27,6 +27,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Identify Changed Files
         id: changed-files
@@ -54,7 +55,7 @@ jobs:
 
       - name: Restore lychee cache
         if: steps.changed-files.outputs.HAS_CHANGES == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: .lycheecache
           key: cache-lychee-${{ github.sha }}

.github/workflows/link_checker_report.yaml

@@ -26,6 +26,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Link Checker
         id: lychee-check

.github/workflows/lint.yaml

@@ -37,6 +37,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0

.github/workflows/nightly_tier_report.yml

@@ -29,9 +29,11 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: 'go.mod'
 

.github/workflows/publish-mcp.yml

@@ -30,6 +30,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        with:
+          persist-credentials: false
 
       - name: Wait for image in Artifact Registry
         shell: bash

.github/workflows/pypi.yml

@@ -29,9 +29,11 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version-file: go.mod
 

.github/workflows/sync-labels.yaml

@@ -30,6 +30,8 @@ jobs:
       pull-requests: 'write'
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c # v1.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/tests.yaml

@@ -47,6 +47,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0