chore: more zizmor fixes

Author: drstrangelooker

.github/workflows/apix-ci.yml

@@ -26,15 +26,14 @@ on:
 
   workflow_dispatch:
 
-permissions:
-  checks: write
-
 env:
   TS_JUNIT_OUTPUT_DIR: results/apix
 
 jobs:
   unit:
     name: Unit - ${{ matrix.os }} / Node ${{ matrix.node-version }}
+    permissions:
+      checks: write
     env:
       JEST_JUNIT_OUTPUT_DIR: results/apix
       JEST_JUNIT_OUTPUT_NAME: ${{ matrix.os }}.apix${{ matrix.node-version }}.xml

.github/workflows/codegen-ci.yml

@@ -22,9 +22,6 @@ on:
 
   workflow_dispatch:
 
-permissions:
-  checks: write
-
 env:
   LOOKERSDK_BASE_URL: https://localhost:20000
   LOOKERSDK_VERIFY_SSL: false
@@ -33,6 +30,8 @@ env:
 jobs:
 
   unit:
+    permissions:
+      checks: write
     env:
       JEST_JUNIT_OUTPUT_DIR: results/sdk-codegen
       JEST_JUNIT_OUTPUT_NAME: ubuntu-latest.sdk-codegen15x.xml
@@ -70,10 +69,12 @@ jobs:
         # TODO: can we cache some layers of the image for faster download?
         # we probably don't want to cache the final image for IP security...
         run: |
-          docker pull --quiet us-west1-docker.pkg.dev/cloud-looker-sdk-codegen-cicd/looker/${{ fromJson(vars.PRIMARY_LOOKER_VERSION)[0] }}
+          docker pull --quiet us-west1-docker.pkg.dev/cloud-looker-sdk-codegen-cicd/looker/${PRIMARY_LOOKER_VERSION}
           # set $LOOKER_OPTS to --no-ssl if we want to turn off ssl
-          docker run --name looker-sdk-codegen-ci -d -p 10000:9999 -p 20000:19999 us-west1-docker.pkg.dev/cloud-looker-sdk-codegen-cicd/looker/${{ fromJson(vars.PRIMARY_LOOKER_VERSION)[0] }}
+          docker run --name looker-sdk-codegen-ci -d -p 10000:9999 -p 20000:19999 us-west1-docker.pkg.dev/cloud-looker-sdk-codegen-cicd/looker/${PRIMARY_LOOKER_VERSION}
           docker logs -f looker-sdk-codegen-ci --until=30s &
+        env:
+          PRIMARY_LOOKER_VERSION: ${{ fromJson(vars.PRIMARY_LOOKER_VERSION)[0] }}
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:

.github/workflows/fix-npm.yml

@@ -3,6 +3,8 @@ name: Fix NPM info
 on:
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
 
   fix:

.github/workflows/go-ci.yml

@@ -15,7 +15,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  checks: write
+  contents: read
 
 env:
   LOOKERSDK_BASE_URL: https://localhost:20000

.github/workflows/lerna-publish.yml

@@ -12,6 +12,8 @@ on:
 
 jobs:
   publish:
+    permissions:
+      contents: read
     if: >
       (github.event.inputs) ||
       (startsWith(github.event.release.tag_name, 'sdk-codegen-all') &&
@@ -46,14 +48,17 @@ jobs:
 
       - name: Pull and run Looker docker image
         run: |
-          docker pull --quiet us-west1-docker.pkg.dev/cloud-looker-sdk-codegen-cicd/looker/${{ fromJson(vars.PRIMARY_LOOKER_VERSION)[0] }}
-          docker run --name looker-sdk-codegen-ci -d -p 10000:9999 -p 20000:19999 us-west1-docker.pkg.dev/cloud-looker-sdk-codegen-cicd/looker/${{ fromJson(vars.PRIMARY_LOOKER_VERSION)[0] }}
+          docker pull --quiet us-west1-docker.pkg.dev/cloud-looker-sdk-codegen-cicd/looker/${PRIMARY_LOOKER_VERSION}
+          docker run --name looker-sdk-codegen-ci -d -p 10000:9999 -p 20000:19999 us-west1-docker.pkg.dev/cloud-looker-sdk-codegen-cicd/looker/${PRIMARY_LOOKER_VERSION}
           docker logs -f looker-sdk-codegen-ci --until=30s &
+        env:
+          PRIMARY_LOOKER_VERSION: ${{ fromJson(vars.PRIMARY_LOOKER_VERSION)[0] }}
 
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22.x
           registry-url: https://wombat-dressing-room.appspot.com
+          package-manager-cache: false
 
       - name: Install dependencies and build
         run: |

.github/workflows/python-ci.yml

@@ -24,7 +24,7 @@ env:
   TOX_JUNIT_OUTPUT_DIR: results
 
 permissions:
-  checks: write
+  contents: read
 
 jobs:
   typecheck:

.github/workflows/python-publish.yml

@@ -16,6 +16,8 @@ defaults:
 
 jobs:
   publish:
+    permissions:
+      contents: read
     if: >
       (github.event.inputs) ||
       (startsWith(github.event.release.tag_name, 'looker_sdk') &&
@@ -37,8 +39,8 @@ jobs:
           pip install wheel
           python setup.py sdist bdist_wheel
 
-      - uses: pypa/gh-action-pypi-publish@54b39fb9371c0b3a6f9f14bb8a67394defc7a806 # v1.4.1
+      - uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
         with:
           user: __token__
-          password: ${{ secrets.PYPI_API_TOKEN }}
+          password: ${{ secrets.PYPI_API_TOKEN }} # zizmor: ignore[use-trusted-publishing]
           packages_dir: python/dist/

.github/workflows/release-metrics.yml

@@ -2,6 +2,9 @@ name: Send publish metrics to bigquery
 on:
   release:
     types: published
+
+permissions: {}
+
 jobs:
   publish:
     runs-on: ubuntu-latest

.github/workflows/release-please.yml

@@ -7,6 +7,8 @@ on:
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - uses: google-github-actions/release-please-action@c078ea33917ab8cfa5300e48f4b7e6b16606aede # v3.7.8
         with:

.github/workflows/required-checks-hack-ci.yml

@@ -92,7 +92,7 @@ jobs:
 
       - name: Debug info
         run: |
-          echo "${{ toJSON(steps.filter.outputs) }}"
+          echo "${STEPS_FILTER_OUTPUTS}"
           echo "apix: ${STEPS_FILTER_OUTPUTS_APIX}"
           echo "codegen: ${STEPS_FILTER_OUTPUTS_CODEGEN}"
           echo "hackathon: ${STEPS_FILTER_OUTPUTS_HACKATHON}"
@@ -101,6 +101,7 @@ jobs:
           echo "tssdk: ${STEPS_FILTER_OUTPUTS_TSSDK}"
           echo "gosdk: ${STEPS_FILTER_OUTPUTS_GOSDK}"
         env:
+          STEPS_FILTER_OUTPUTS: ${{ toJSON(steps.filter.outputs) }}
           STEPS_FILTER_OUTPUTS_APIX: ${{ steps.filter.outputs.apix }}
           STEPS_FILTER_OUTPUTS_CODEGEN: ${{ steps.filter.outputs.codegen }}
           STEPS_FILTER_OUTPUTS_HACKATHON: ${{ steps.filter.outputs.hackathon }}