chore(gha): add zizmor, fix issues

Author: cgoetz-inovex

.github/workflows/cd.yaml

@@ -5,18 +5,20 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   check-version:
     runs-on: ubuntu-latest
-    permissions: 
-      pull-requests: write
+    permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
+          persist-credentials: true # Needed to push release tags.
       - name: install uv & python
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: "0.13.7"
           python-version: "3.11"

.github/workflows/ci.yaml

@@ -2,6 +2,8 @@ name: CI Workflow
 
 on: [pull_request, workflow_dispatch]
 
+permissions: {}
+
 jobs:
   main:
     name: CI
@@ -12,9 +14,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:      
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
       - name: install uv and python
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: "0.13.7"
           python-version: ${{ matrix.python-version }}

.github/workflows/dependency-checker.yaml

@@ -5,24 +5,27 @@ on:
     - cron: "0 0 * * *"
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   dependency_updater:
     name: Dependency-Updater
     runs-on: ubuntu-latest
-    permissions: 
-      pull-requests: write
+    permissions:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: true # Needed to push dependency-update branches.
       - name: install uv and python
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           version: "0.13.7"
           python-version: "3.11"
       - name: UV Python dependency updater
         env:
-          GH_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          GH_TOKEN: ${{ secrets.RENOVATE_TOKEN }} # Used for PR operations.
         run: |
             git config --global user.name "SDK Updater Bot"
             git config --global user.email "noreply@stackit.de"

.github/workflows/labeler.yaml

@@ -7,12 +7,13 @@ on:
     # run every full hour (to still label PRs from forks)
     - cron: '0 * * * *'
 
+permissions: {}
+
 jobs:
   labeler:
     permissions:
       contents: read
       pull-requests: write
-      issues: write
     # don't run on PRs from forks (token has no write permissions)
     if: ${{ github.event.pull_request.head.repo.full_name == github.repository }}
     name: "Labeler"
@@ -23,7 +24,7 @@ jobs:
         run: |
           curl -sSL -o remote-labeler.yml https://raw.githubusercontent.com/stackitcloud/stackit-sdk-go/main/.github/labeler.yml 
       - name: Labeler action
-        uses: actions/labeler@v6
+        uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
         with:
           configuration-path: "remote-labeler.yml"
           sync-labels: false

.github/workflows/stale.yaml

@@ -13,18 +13,18 @@ env:
   DAYS_BEFORE_PR_CLOSE: 14
   EXEMPT_PR_LABELS: "ignore-stale"
 
-permissions:
-  issues: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   stale:
     name: "Stale"
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write
     timeout-minutes: 10
     steps:
       - name: "Mark old PRs as stale"
-        uses: actions/stale@v9
+        uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           stale-pr-message: "This PR was marked as stale after ${{ env.DAYS_BEFORE_PR_STALE }} days of inactivity and will be closed after another ${{ env.DAYS_BEFORE_PR_CLOSE }} days of further inactivity. If this PR should be kept open, just add a comment, remove the stale label or push new commits to it."

.github/workflows/zizmor.yaml

@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required to upload SARIF to code scanning.
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
+        with:
+          version: v1.32.0