fix(ci): resolve zizmor security findings in GitHub Actions workflows

.github/workflows/analyze-releases-for-adk-docs-updates.yml

@@ -45,10 +45,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
 

.github/workflows/block-merge.yml

@@ -19,6 +19,9 @@ on:
     branches: [main]
     types: [opened, reopened, synchronize]
 
+permissions:
+  contents: read
+
 jobs:
   block-merge:
     if: github.repository == 'google/adk-python'

.github/workflows/continuous-integration.yml

@@ -40,7 +40,9 @@
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Run pre-commit checks
         uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
@@ -56,12 +58,13 @@
         python-version: ['3.10', '3.11', '3.12', '3.13']
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -127,10 +130,12 @@
     timeout-minutes: 10
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -169,10 +174,12 @@
     timeout-minutes: 10
     steps:
       - name: Checkout code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/copybara-pr-handler.yml

@@ -40,7 +40,7 @@ jobs:
 
     steps:
       - name: Check for Copybara commits and close PRs
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           github-token: ${{ secrets.ADK_TRIAGE_AGENT }}
           script: |

.github/workflows/discussion_answering.yml

@@ -34,16 +34,18 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
 
       - name: Authenticate to Google Cloud
         id: auth
-        uses: 'google-github-actions/auth@v3'
+        uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # v3
         with:
           credentials_json: '${{ secrets.ADK_GCP_SA_KEY }}'
 

.github/workflows/issue-maintenance.yml

@@ -36,7 +36,7 @@
         default: true
 
 permissions:
   issues: write
   contents: read
 
 env:
@@ -58,10 +58,12 @@
     timeout-minutes: 120
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
 
@@ -84,10 +86,12 @@
     timeout-minutes: 60
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
 

.github/workflows/pr-triage.yml

@@ -14,7 +14,7 @@
 
 name: ADK Pull Request Triaging Agent
 
 on:
   # React within seconds of a PR opening/updating so the owner is assigned
   # promptly. pull_request_target (not pull_request) is required so the run has
   # the base-repo token needed to assign on community fork PRs; this workflow
@@ -52,10 +52,12 @@
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
 

.github/workflows/release-cherry-pick.yml

@@ -51,8 +51,9 @@ jobs:
             echo "candidate_branch=release/candidate" >> $GITHUB_OUTPUT
           fi
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
+          persist-credentials: false
           ref: ${{ steps.config.outputs.candidate_branch }}
           token: ${{ secrets.RELEASE_PAT }}
           fetch-depth: 0
@@ -73,16 +74,18 @@ jobs:
           fi
 
       - name: Cherry-pick commit
+        env:
+          CANDIDATE_BRANCH: ${{ steps.config.outputs.candidate_branch }}
         run: |
-          CANDIDATE_BRANCH="${{ steps.config.outputs.candidate_branch }}"
           echo "Cherry-picking ${INPUTS_COMMIT_SHA} to $CANDIDATE_BRANCH"
           git cherry-pick ${INPUTS_COMMIT_SHA}
         env:
           INPUTS_COMMIT_SHA: ${{ inputs.commit_sha }}
 
       - name: Push changes
+        env:
+          CANDIDATE_BRANCH: ${{ steps.config.outputs.candidate_branch }}
         run: |
-          CANDIDATE_BRANCH="${{ steps.config.outputs.candidate_branch }}"
           git push origin "$CANDIDATE_BRANCH"
           echo "Successfully cherry-picked commit to $CANDIDATE_BRANCH"
           echo "If you want to regenerate the changelog PR, run the 'Release: Cut' workflow manually"

.github/workflows/release-cut.yml

@@ -69,15 +69,16 @@
       # Action: CUT NEW RELEASE
       - name: Checkout base ref (Cut)
         if: inputs.action == 'cut'
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
+          persist-credentials: false
           ref: ${{ inputs.commit_sha || steps.config.outputs.base_ref }}
           token: ${{ secrets.RELEASE_PAT }}
 
       - name: Check for existing candidate branch (Cut)
         if: inputs.action == 'cut'
         run: |
           CANDIDATE_BRANCH="${{ steps.config.outputs.candidate_branch }}"
           if git ls-remote --exit-code --heads origin "$CANDIDATE_BRANCH" &>/dev/null; then
             echo "Error: Branch $CANDIDATE_BRANCH already exists."
             echo "Please finalize or delete the existing release candidate before starting a new one."
@@ -86,24 +87,26 @@
 
       - name: Create and push candidate branch (Cut)
         if: inputs.action == 'cut'
+        env:
+          CANDIDATE_BRANCH: ${{ steps.config.outputs.candidate_branch }}
         run: |
-          CANDIDATE_BRANCH="${{ steps.config.outputs.candidate_branch }}"
           git checkout -b "$CANDIDATE_BRANCH"
           git push origin "$CANDIDATE_BRANCH"
           echo "Created and pushed branch: $CANDIDATE_BRANCH"
 
       # Action: REGENERATE EXISTING PR
       - name: Checkout existing candidate branch (Regenerate)
         if: inputs.action == 'regenerate'
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
+          persist-credentials: false
           ref: ${{ steps.config.outputs.candidate_branch }}
           token: ${{ secrets.RELEASE_PAT }}
 
       # Run Release Please
       - name: Run Release Please
         id: release_please
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
         with:
           token: ${{ secrets.RELEASE_PAT }}
           config-file: ${{ steps.config.outputs.config_file }}
@@ -118,7 +121,7 @@
       # so it also runs when release-please updates an existing PR (regenerate).
       - name: Set up Python
         if: steps.release_please.outputs.pr != ''
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
 

.github/workflows/release-finalize.yml

@@ -47,8 +47,9 @@ jobs:
       - name: Determine Branch Configurations
         if: steps.check.outputs.is_release_pr == 'true'
         id: config
+        env:
+          CANDIDATE_BRANCH: ${{ github.event.pull_request.base.ref }}
         run: |
-          CANDIDATE_BRANCH="${{ github.event.pull_request.base.ref }}"
           if [ "$CANDIDATE_BRANCH" = "release/v1-candidate" ]; then
             echo "base_branch=v1" >> $GITHUB_OUTPUT
             echo "config_file=.github/release-please-config-v1.json" >> $GITHUB_OUTPUT
@@ -59,18 +60,21 @@ jobs:
             echo "manifest_file=.github/.release-please-manifest.json" >> $GITHUB_OUTPUT
           fi
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         if: steps.check.outputs.is_release_pr == 'true'
         with:
+          persist-credentials: false
           ref: ${{ github.event.pull_request.base.ref }}
           token: ${{ secrets.RELEASE_PAT }}
           fetch-depth: 0
 
       - name: Extract version from manifest
         if: steps.check.outputs.is_release_pr == 'true'
         id: version
+        env:
+          MANIFEST_FILE: ${{ steps.config.outputs.manifest_file }}
         run: |
-          VERSION=$(jq -r '.["."]' "${{ steps.config.outputs.manifest_file }}")
+          VERSION=$(jq -r '.["."]' "$MANIFEST_FILE")
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "Extracted version: $VERSION"
 
@@ -85,10 +89,11 @@ jobs:
 
       - name: Record last-release-sha for release-please
         if: steps.check.outputs.is_release_pr == 'true'
+        env:
+          BASE_BRANCH: ${{ steps.config.outputs.base_branch }}
+          CONFIG_FILE: ${{ steps.config.outputs.config_file }}
+          CANDIDATE_BRANCH: ${{ github.event.pull_request.base.ref }}
         run: |
-          BASE_BRANCH="${{ steps.config.outputs.base_branch }}"
-          CONFIG_FILE="${{ steps.config.outputs.config_file }}"
-          CANDIDATE_BRANCH="${{ github.event.pull_request.base.ref }}"
 
           git fetch origin "$BASE_BRANCH"
           CUT_SHA=$(git merge-base "origin/$BASE_BRANCH" HEAD)
@@ -103,9 +108,11 @@ jobs:
 
       - name: Rename candidate to release/v{version}
         if: steps.check.outputs.is_release_pr == 'true'
+        env:
+          STEPS_VERSION_OUTPUTS_VERSION: ${{ steps.version.outputs.version }}
+          CANDIDATE_BRANCH: ${{ github.event.pull_request.base.ref }}
         run: |
           VERSION="v${STEPS_VERSION_OUTPUTS_VERSION}"
-          CANDIDATE_BRANCH="${{ github.event.pull_request.base.ref }}"
           git push origin "$CANDIDATE_BRANCH:refs/heads/release/$VERSION" ":$CANDIDATE_BRANCH"
           echo "Renamed $CANDIDATE_BRANCH to release/$VERSION"
         env:

.github/workflows/release-publish.yml

@@ -23,6 +23,7 @@
 permissions:
   contents: write
   pull-requests: write
+  id-token: write
 
 jobs:
   publish:
@@ -36,7 +37,9 @@
             exit 1
           fi
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Determine Release Type and Extract Version
         id: version
@@ -73,7 +76,7 @@
           enable-cache: true
 
       - name: Set up Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.2.0
         with:
           python-version: "3.11"
 

.github/workflows/release-update-adk-web.yaml

@@ -36,15 +36,18 @@
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         persist-credentials: false
 
     - name: Fetch and unzip frontend assets
+      env:
+        ADK_WEB_REPO: ${{ github.event.inputs.adk_web_repo }}
+        ADK_WEB_TAG: ${{ github.event.inputs.adk_web_tag }}
       run: |
         TARGET_DIR="src/google/adk/cli/browser"
-        REPO="${{ github.event.inputs.adk_web_repo }}"
-        TAG="${{ github.event.inputs.adk_web_tag }}"
+        REPO="$ADK_WEB_REPO"
+        TAG="$ADK_WEB_TAG"
         # Clean target directory
         rm -rf "$TARGET_DIR"/*
         mkdir -p "$TARGET_DIR"
@@ -78,7 +81,7 @@
         echo "email=$(echo "$USER_JSON" | jq -r '.id')+$(echo "$USER_JSON" | jq -r '.login')@users.noreply.github.com" >> $GITHUB_OUTPUT
 
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6
+      uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.4.0
       with:
         token: ${{ secrets.RELEASE_PAT }}
         commit-message: "Update compiled adk web files from ${{ github.event.inputs.adk_web_repo }}@${{ github.event.inputs.adk_web_tag || 'latest' }}"

.github/workflows/upload-adk-docs-to-vertex-ai-search.yml

@@ -31,7 +31,9 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Clone adk-docs repository
         run: git clone https://github.com/google/adk-docs.git /tmp/adk-docs
@@ -40,13 +42,13 @@ jobs:
         run: git clone https://github.com/google/adk-python.git /tmp/adk-python
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.11'
 
       - name: Authenticate to Google Cloud
         id: auth
-        uses: 'google-github-actions/auth@v3'
+        uses: 'google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093' # v3
         with:
           credentials_json: '${{ secrets.ADK_GCP_SA_KEY }}'