From bb741a81dad412307a801ad04bac820339bf3e61 Mon Sep 17 00:00:00 2001
From: Clement Tsang <34804052+ClementTsang@users.noreply.github.com>
Date: Mon, 17 Aug 2026 23:19:42 -0400
Subject: [PATCH] ci: run zizmor on GHA workflows (#2201)

Use zizmor to protect our workflows a bit better. Done buy running zizmor ./ --fix=unsafe-only.

We should also probably add zizmor to our CI pipeline.
---
 .github/workflows/audit.yml                |  2 ++
 .github/workflows/build_releases.yml       | 29 ++++++++++++++++------
 .github/workflows/ci.yml                   |  4 +++
 .github/workflows/clear_workflow_cache.yml | 12 ++++++---
 .github/workflows/coverage.yml             |  2 ++
 .github/workflows/deployment.yml           | 23 +++++++++++------
 .github/workflows/docs.yml                 | 12 ++++++---
 .github/workflows/nightly.yml              |  7 ++++--
 .github/workflows/post_release.yml         | 20 +++++++++------
 .github/workflows/publish_github_pages.yml |  1 +
 .github/workflows/test_docs.yml            |  1 +
 .github/workflows/validate_schema.yml      |  1 +
 12 files changed, 82 insertions(+), 32 deletions(-)

diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 631b6c36..0c7388d3 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -29,6 +29,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Enable Rust cache
         uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # 2.9.1
diff --git a/.github/workflows/build_releases.yml b/.github/workflows/build_releases.yml
index 1b6b1939..2d7a1e7d 100644
--- a/.github/workflows/build_releases.yml
+++ b/.github/workflows/build_releases.yml
@@ -173,6 +173,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       # TODO: Make this and the toolchain step a separate wrapper action?
       - name: Read Rust version
@@ -237,11 +238,13 @@ jobs:
         shell: bash
         run: |
           mkdir -p signed
-          if [[ ${{ inputs.caller }} == "nightly" ]]; then
+          if [[ ${INPUTS_CALLER} == "nightly" ]]; then
             echo "slug=test-signing" >> $GITHUB_OUTPUT
           else
             echo "slug=release-signing" >> $GITHUB_OUTPUT
           fi
+        env:
+          INPUTS_CALLER: ${{ inputs.caller }}
 
       - name: Upload unsigned Windows artifact
         id: upload-unsigned-artifact
@@ -292,7 +295,7 @@ jobs:
         shell: bash
         run: |
           mkdir release
-          mv ${{ env.ASSET }} release/
+          mv ${ASSET} release/
 
       - name: Compress completion files
         if: matrix.info.generate-other-artifacts == true
@@ -345,6 +348,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Install Net-Framework-Core
         shell: powershell
@@ -444,6 +448,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Read Rust version
         shell: bash
@@ -529,7 +534,9 @@ jobs:
         shell: bash
         run: |
           mkdir release
-          mv ${{ steps.verify.outputs.DEB_FILE }} release/
+          mv ${STEPS_VERIFY_OUTPUTS_DEB_FILE} release/
+        env:
+          STEPS_VERIFY_OUTPUTS_DEB_FILE: ${{ steps.verify.outputs.DEB_FILE }}
 
       - name: Save release as artifact
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
@@ -554,6 +561,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Read Rust version
         shell: bash
@@ -614,14 +622,18 @@ jobs:
 
       - name: Check generated rpm file signatures
         run: |
-          rpm --checksig --verbose ${{ steps.verify.outputs.RPM_FILE }}
+          rpm --checksig --verbose ${STEPS_VERIFY_OUTPUTS_RPM_FILE}
           # Validate modern signature digest exist, see https://github.com/ClementTsang/bottom/issues/1848
-          rpm --checksig --verbose ${{ steps.verify.outputs.RPM_FILE }} | grep -q "SHA256"
+          rpm --checksig --verbose ${STEPS_VERIFY_OUTPUTS_RPM_FILE} | grep -q "SHA256"
+        env:
+          STEPS_VERIFY_OUTPUTS_RPM_FILE: ${{ steps.verify.outputs.RPM_FILE }}
 
       - name: Test installing generated rpm file
         run: |
-          yum localinstall -y ${{ steps.verify.outputs.RPM_FILE }}
+          yum localinstall -y ${STEPS_VERIFY_OUTPUTS_RPM_FILE}
           btm -V
+        env:
+          STEPS_VERIFY_OUTPUTS_RPM_FILE: ${{ steps.verify.outputs.RPM_FILE }}
 
       - name: Delete generated rpm folder
         run: |
@@ -637,7 +649,9 @@ jobs:
         shell: bash
         run: |
           mkdir release
-          mv ${{ steps.verify.outputs.RPM_FILE }} release/
+          mv ${STEPS_VERIFY_OUTPUTS_RPM_FILE} release/
+        env:
+          STEPS_VERIFY_OUTPUTS_RPM_FILE: ${{ steps.verify.outputs.RPM_FILE }}
 
       - name: Save release as artifact
         uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
@@ -663,6 +677,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Read Rust version
         shell: bash
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 394eb92c..1a3e38d7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -77,6 +77,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Read Rust version
         shell: bash
@@ -280,6 +282,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Read Rust version
         shell: bash
diff --git a/.github/workflows/clear_workflow_cache.yml b/.github/workflows/clear_workflow_cache.yml
index 3bafff7b..1e79efe1 100644
--- a/.github/workflows/clear_workflow_cache.yml
+++ b/.github/workflows/clear_workflow_cache.yml
@@ -26,20 +26,24 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       # We run each script twice with a small delay in between to try and catch everything.
       - name: Clear cache
         run: |
-          if [[ -n "${{ github.event.schedule }}" ]]; then
+          if [[ -n "${GITHUB_EVENT_SCHEDULE}" ]]; then
             python ./scripts/clear_cache.py keep-main
             sleep 5
             python ./scripts/clear_cache.py keep-main
-          elif [[ -z "${{ github.event.inputs.id }}" ]]; then
+          elif [[ -z "${GITHUB_EVENT_INPUTS_ID}" ]]; then
             python ./scripts/clear_cache.py ${{ github.event.pull_request.number }}
             sleep 5
             python ./scripts/clear_cache.py ${{ github.event.pull_request.number }}
           else
-            python ./scripts/clear_cache.py ${{ github.event.inputs.id }}
+            python ./scripts/clear_cache.py ${GITHUB_EVENT_INPUTS_ID}
             sleep 5
-            python ./scripts/clear_cache.py ${{ github.event.inputs.id }}
+            python ./scripts/clear_cache.py ${GITHUB_EVENT_INPUTS_ID}
           fi
+        env:
+          GITHUB_EVENT_SCHEDULE: ${{ github.event.schedule }}
+          GITHUB_EVENT_INPUTS_ID: ${{ github.event.inputs.id }}
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 4da16b49..559a554f 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -50,6 +50,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Read Rust version
         shell: bash
diff --git a/.github/workflows/deployment.yml b/.github/workflows/deployment.yml
index da512968..27c835e8 100644
--- a/.github/workflows/deployment.yml
+++ b/.github/workflows/deployment.yml
@@ -29,16 +29,18 @@ jobs:
       - name: Get the release version from the tag
         if: env.VERSION == ''
         run: |
-          if [[ -n "${{ github.event.inputs.tag }}" ]]; then
+          if [[ -n "${GITHUB_EVENT_INPUTS_TAG}" ]]; then
             echo "Manual run against a tag; overriding actual tag in the environment..."
-            echo "VERSION=${{ github.event.inputs.tag }}" >> $GITHUB_ENV
+            echo "VERSION=${GITHUB_EVENT_INPUTS_TAG}" >> $GITHUB_ENV
           else
             echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_ENV
           fi
+        env:
+          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
 
       - name: Validate version environment variable
         run: |
-          echo "Version being built against is version ${{ env.VERSION }}"!
+          echo "Version being built against is version ${VERSION}"!
 
   build-release:
     needs: [initialize]
@@ -60,15 +62,18 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Set release version
         shell: bash
         run: |
-          echo "RELEASE_VERSION=${{ needs.initialize.outputs.version }}" >> $GITHUB_ENV
+          echo "RELEASE_VERSION=${NEEDS_INITIALIZE_OUTPUTS_VERSION}" >> $GITHUB_ENV
+        env:
+          NEEDS_INITIALIZE_OUTPUTS_VERSION: ${{ needs.initialize.outputs.version }}
 
       - name: Validate release version
         run: |
-          echo "Release version: ${{ env.RELEASE_VERSION }}"
+          echo "Release version: ${RELEASE_VERSION}"
 
       - name: Get release artifacts
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
@@ -79,7 +84,7 @@ jobs:
 
       - name: Execute choco packaging script
         run: |
-          python "./scripts/windows/choco/choco_packager.py" "./release/bottom_x86_64-pc-windows-msvc.zip" ${{ env.RELEASE_VERSION }} "./scripts/windows/choco/bottom.nuspec.template" "./scripts/windows/choco/chocolateyinstall.ps1.template" "bottom.nuspec" "tools/chocolateyinstall.ps1" "tools/"
+          python "./scripts/windows/choco/choco_packager.py" "./release/bottom_x86_64-pc-windows-msvc.zip" ${RELEASE_VERSION} "./scripts/windows/choco/bottom.nuspec.template" "./scripts/windows/choco/chocolateyinstall.ps1.template" "bottom.nuspec" "tools/chocolateyinstall.ps1" "tools/"
           zip -r choco.zip "bottom.nuspec" "tools"
 
       - name: Move release file into release directory
@@ -104,11 +109,13 @@ jobs:
       - name: Set release version
         shell: bash
         run: |
-          echo "RELEASE_VERSION=${{ needs.initialize.outputs.version }}" >> $GITHUB_ENV
+          echo "RELEASE_VERSION=${NEEDS_INITIALIZE_OUTPUTS_VERSION}" >> $GITHUB_ENV
+        env:
+          NEEDS_INITIALIZE_OUTPUTS_VERSION: ${{ needs.initialize.outputs.version }}
 
       - name: Validate release version
         run: |
-          echo "Release version: ${{ env.RELEASE_VERSION }}"
+          echo "Release version: ${RELEASE_VERSION}"
 
       - name: Get release artifacts
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 45593ecb..65b154ed 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -39,6 +39,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
@@ -53,13 +54,16 @@ jobs:
       - name: Build and deploy docs with mike
         run: |
           cd docs
-          if [[ -n "${{ inputs.alias }}" ]]; then
-            mike deploy --push ${{ inputs.version }} --update-aliases ${{ inputs.alias }}
-          elif [[ "${{ inputs.version }}" == "nightly" ]]; then
-            mike deploy --push ${{ inputs.version }}
+          if [[ -n "${INPUTS_ALIAS}" ]]; then
+            mike deploy --push ${INPUTS_VERSION} --update-aliases ${INPUTS_ALIAS}
+          elif [[ "${INPUTS_VERSION}" == "nightly" ]]; then
+            mike deploy --push ${INPUTS_VERSION}
           else
             mike deploy --push nightly
           fi
+        env:
+          INPUTS_ALIAS: ${{ inputs.alias }}
+          INPUTS_VERSION: ${{ inputs.version }}
 
   publish-gh-pages:
     needs: [build-documentation]
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 729f8d50..d40c01e0 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -38,13 +38,15 @@ jobs:
 
       - name: Check if mock
         run: |
-          if [[ -z "${{ github.event.inputs.isMock }}" ]]; then
+          if [[ -z "${GITHUB_EVENT_INPUTS_ISMOCK}" ]]; then
             echo "This is a scheduled nightly run."
-          elif [[ "${{ github.event.inputs.isMock }}" == "true" ]]; then
+          elif [[ "${GITHUB_EVENT_INPUTS_ISMOCK}" == "true" ]]; then
             echo "This is a mock run."
           else
             echo "This is NOT a mock run. Watch for the generated files!"
           fi
+        env:
+          GITHUB_EVENT_INPUTS_ISMOCK: ${{ github.event.inputs.isMock }}
 
   build-release:
     needs: initialize-job
@@ -71,6 +73,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Get release artifacts
         uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
diff --git a/.github/workflows/post_release.yml b/.github/workflows/post_release.yml
index bf593b62..1428937c 100644
--- a/.github/workflows/post_release.yml
+++ b/.github/workflows/post_release.yml
@@ -29,17 +29,20 @@ jobs:
     steps:
       - name: Get the release version from the tag
         run: |
-          if [[ -n "${{ github.event.inputs.tag }}" ]]; then
+          if [[ -n "${GITHUB_EVENT_INPUTS_TAG}" ]]; then
             echo "Manual run against a tag; overriding actual tag in the environment..."
-            echo "VERSION=${{ github.event.inputs.tag }}" >> "$GITHUB_ENV"
+            echo "VERSION=${GITHUB_EVENT_INPUTS_TAG}" >> "$GITHUB_ENV"
           else
-            echo "VERSION=${{ github.event.release.tag_name }}" >> "$GITHUB_ENV"
+            echo "VERSION=${GITHUB_EVENT_RELEASE_TAG_NAME}" >> "$GITHUB_ENV"
           fi
+        env:
+          GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
+          GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
 
       - name: Make sure you're not on master/main/nightly
         run: |
-          echo ${{ env.VERSION }}
-          if [[ ${{ env.VERSION }} == "master" || ${{ env.VERSION }}  == "main" || ${{ env.VERSION }}  == "nightly" ]]; then
+          echo ${VERSION}
+          if [[ ${VERSION} == "master" || ${VERSION}  == "main" || ${VERSION}  == "nightly" ]]; then
             exit 1
           fi
 
@@ -62,11 +65,13 @@ jobs:
       - name: Set release version
         shell: bash
         run: |
-          echo "RELEASE_VERSION=${{ needs.initialize.outputs.version }}" >> $GITHUB_ENV
+          echo "RELEASE_VERSION=${NEEDS_INITIALIZE_OUTPUTS_VERSION}" >> $GITHUB_ENV
+        env:
+          NEEDS_INITIALIZE_OUTPUTS_VERSION: ${{ needs.initialize.outputs.version }}
 
       - name: Validate release version
         run: |
-          echo "Release version: ${{ env.RELEASE_VERSION }}"
+          echo "Release version: ${RELEASE_VERSION}"
       - name: Trigger choco
         run: |
           curl -X POST https://api.github.com/repos/ClementTsang/choco-bottom/dispatches \
@@ -85,6 +90,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: rust-lang/crates-io-auth-action@bbd81622f20ce9e2dd9622e3218b975523e45bbe # v1.0.4
         id: auth
diff --git a/.github/workflows/publish_github_pages.yml b/.github/workflows/publish_github_pages.yml
index 4be8e17f..59287a0a 100644
--- a/.github/workflows/publish_github_pages.yml
+++ b/.github/workflows/publish_github_pages.yml
@@ -20,6 +20,7 @@ jobs:
           ref: gh-pages
           submodules: recursive
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Upload artifact
         id: upload
diff --git a/.github/workflows/test_docs.yml b/.github/workflows/test_docs.yml
index c69f5b25..aaf32c4f 100644
--- a/.github/workflows/test_docs.yml
+++ b/.github/workflows/test_docs.yml
@@ -35,6 +35,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
diff --git a/.github/workflows/validate_schema.yml b/.github/workflows/validate_schema.yml
index 14e334ef..695d76f9 100644
--- a/.github/workflows/validate_schema.yml
+++ b/.github/workflows/validate_schema.yml
@@ -44,6 +44,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with: