From 10a6a20ac4f6012d08dcd2886dcb187d4e14b92e Mon Sep 17 00:00:00 2001
From: Husam <husameldawi@google.com>
Date: Tue, 30 Jun 2026 01:45:12 +0000
Subject: [PATCH] chore(actions): address zizmor findings

This PR is an AI assisted attempt to address zizmor findings. It may not catch everything, and should be reviewed by repository owners. If it is unhelpful, feel free to close the PR and address separately. If it is helpful, feel free to approve and merge, or edit/modify as needed to get it to the right state. Repository owners must ultimately ensure compliance by 2026-07-13. The purpose of this PR is to provide some assistance with achieving that as a first pass. This will become a blocking check for new changes to github workflows on 2026-07-13.
---
 .github/workflows/ci.yaml              |  3 +++
 .github/workflows/issues-no-repro.yaml |  8 +++++---
 .github/workflows/response.yaml        | 12 ++++++++----
 .github/workflows/update-apis.yaml     |  3 +++
 4 files changed, 19 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 76f594db6c6..5063cee3b24 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,4 +1,7 @@
 on:
+
+permissions:
+  contents: read
   push:
     branches:
       - main
diff --git a/.github/workflows/issues-no-repro.yaml b/.github/workflows/issues-no-repro.yaml
index 978863915b1..17a3d170c30 100644
--- a/.github/workflows/issues-no-repro.yaml
+++ b/.github/workflows/issues-no-repro.yaml
@@ -10,13 +10,15 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: 18
       - run: npm install
         working-directory: ./.github/scripts
-      - uses: actions/github-script@v8
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const script = require('./.github/scripts/close-invalid-link.cjs')
diff --git a/.github/workflows/response.yaml b/.github/workflows/response.yaml
index e81a3603af5..90035fe1a71 100644
--- a/.github/workflows/response.yaml
+++ b/.github/workflows/response.yaml
@@ -13,8 +13,10 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/github-script@v7
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const script = require('./.github/scripts/close-unresponsive.cjs')
@@ -27,8 +29,10 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/github-script@v7
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        with:
+          persist-credentials: false
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const script = require('./.github/scripts/remove-response-label.cjs')
diff --git a/.github/workflows/update-apis.yaml b/.github/workflows/update-apis.yaml
index 8da90517e1d..fba2693b17a 100644
--- a/.github/workflows/update-apis.yaml
+++ b/.github/workflows/update-apis.yaml
@@ -1,4 +1,7 @@
 on:
+
+permissions:
+  contents: read
   schedule:
     - cron: "0 1 * * *"
   workflow_dispatch: