ci: add shared security scanning workflow

.github/actions/setup/action.yaml

@@ -13,19 +13,19 @@ runs:
   using: "composite"
   steps:
     - name: Set up Helm
-      uses: azure/setup-helm@v5.0.0
+      uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
       with:
         version: ${{ inputs.helm-version }}
 
-    - uses: actions/setup-python@v6.2.0
+    - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
         python-version: 3.14
 
     - name: Set up chart-testing
-      uses: helm/chart-testing-action@v2.8.0
+      uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
 
     - name: Create kind cluster
-      uses: helm/kind-action@v1.14.0
+      uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
       if: ${{ inputs.create-kind-cluster == 'true' }}
       with:
         config: ./.github/kind-1.33.yaml

.github/dependabot.yml

@@ -4,3 +4,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/collector-test.yaml

@@ -17,6 +17,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup
         uses: ./.github/actions/setup

.github/workflows/demo-test.yaml

@@ -21,6 +21,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup
         uses: ./.github/actions/setup

.github/workflows/ebpf-instrumentation-test.yaml

@@ -17,6 +17,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup
         uses: ./.github/actions/setup

.github/workflows/ebpf-test.yaml

@@ -21,6 +21,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup
         uses: ./.github/actions/setup

.github/workflows/fossa.yml

@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
         with:

.github/workflows/kube-stack-test.yaml

@@ -21,6 +21,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup
         uses: ./.github/actions/setup

.github/workflows/lint.yaml

@@ -19,6 +19,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup
         uses: ./.github/actions/setup

.github/workflows/operator-test.yaml

@@ -21,6 +21,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup
         uses: ./.github/actions/setup
@@ -109,6 +110,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup
         uses: ./.github/actions/setup

.github/workflows/pre-commit.yaml

@@ -13,5 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
     - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

.github/workflows/release.yaml

@@ -20,6 +20,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Configure Git
@@ -84,9 +85,12 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Login to Helm OCI Registry
+        env:
+          HELM_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
+          HELM_USERNAME: ${{ github.actor }}
         run: |
-          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io \
-            --username ${{ github.actor }} \
+          echo "$HELM_PASSWORD" | helm registry login ghcr.io \
+            --username "$HELM_USERNAME" \
             --password-stdin
 
       - name: Push charts to GHCR

.github/workflows/sync-readme.yaml

@@ -18,12 +18,14 @@ jobs:
     steps:
       - name: Checkout main
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Copy README to temp
         run: cp -f README.md ${{ runner.temp }}/README.md
 
       - name: Checkout gh-pages
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # zizmor: ignore[artipacked] v7.0.1; persisted token pushes README to gh-pages
         with:
           ref: gh-pages
 

.github/workflows/ta-test.yaml

@@ -21,6 +21,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Setup
         uses: ./.github/actions/setup

.github/workflows/update-chart-app-version.yaml

@@ -2,6 +2,9 @@ name: Update Chart App Version
 
 on:
   workflow_call:
+    secrets:
+      OTELBOT_PRIVATE_KEY:
+        required: true
     inputs:
       chart_name:
         required: true

.github/workflows/update-obi-chart.yaml

@@ -22,7 +22,8 @@ jobs:
       contents: write
       pull-requests: write
     uses: ./.github/workflows/update-chart-app-version.yaml
-    secrets: inherit
+    secrets:
+      OTELBOT_PRIVATE_KEY: ${{ secrets.OTELBOT_PRIVATE_KEY }}
     with:
       chart_name: opentelemetry-ebpf-instrumentation
       chart_root: charts/opentelemetry-ebpf-instrumentation

.github/workflows/update-target-allocator-chart.yaml

@@ -19,7 +19,8 @@ jobs:
       contents: write
       pull-requests: write
     uses: ./.github/workflows/update-chart-app-version.yaml
-    secrets: inherit
+    secrets:
+      OTELBOT_PRIVATE_KEY: ${{ secrets.OTELBOT_PRIVATE_KEY }}
     with:
       chart_name: opentelemetry-target-allocator
       chart_root: charts/opentelemetry-target-allocator

.github/workflows/zizmor.yml

@@ -0,0 +1,18 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '10 4 * * 3' # weekly at 04:10 UTC on Wednesday
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    permissions:
+      contents: read # for actions/checkout
+      security-events: write # for zizmor to upload SARIF results
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0