ci: fix zizmor findings in GitHub Actions workflows

.github/workflows/build-containers.yml

@@ -60,6 +60,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0  # Need full history for change detection
+          persist-credentials: false
 
       - name: Find configuration files to build
         id: find-configs
@@ -197,6 +198,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -268,6 +271,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -431,11 +436,14 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: 'go.mod'
+          cache: false
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0

.github/workflows/build-skills.yml

@@ -56,6 +56,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Find skill configurations to build
         id: find-configs
@@ -182,6 +183,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -212,6 +215,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install yq
         uses: mikefarah/yq@c14f446382944492701b16c1ddb48bb9dbe683e3 # v4.53.6
@@ -398,6 +403,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0

.github/workflows/ci.yml

@@ -22,6 +22,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -40,6 +42,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -60,4 +64,4 @@ jobs:
         run: go mod download
 
       - name: Build
-        run: go build -v ./cmd/dockhand
+        run: go build -v ./cmd/dockhand

.github/workflows/mcp-scan-report.yml

@@ -1,10 +1,17 @@
 # This workflow runs in the context of the base repository and has write access
 # to post PR comments, even for PRs from forks. It triggers after the main
 # build-containers workflow completes and downloads scan result artifacts.
+#
+# `workflow_run` is required for that base-repo write access; the trade-off it
+# flags is a privileged workflow trusting event data from an untrusted run.
+# This workflow never checks out or executes the triggering run's code, and
+# the only value it takes from it (the PR number, read from an artifact) is
+# used solely to target the comment, so a bad value means a comment lands on
+# the wrong PR, not privilege escalation.
 name: MCP Scan Report
 
 on:
-  workflow_run:
+  workflow_run:   # zizmor: ignore[dangerous-triggers]
     workflows: ["Build MCP Server Containers"]
     types: [completed]
 

.github/workflows/periodic-security-scan.yml

@@ -21,6 +21,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Find all configuration files
         id: find-configs
@@ -50,6 +52,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install yq
         uses: mikefarah/yq@c14f446382944492701b16c1ddb48bb9dbe683e3 # v4.53.6

.github/workflows/renovate-validation.yml

@@ -40,6 +40,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -84,6 +86,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
@@ -105,4 +109,4 @@ jobs:
             "$GITHUB_REPO" || {
             echo "::warning::Dry run failed. This might be due to missing permissions or configuration issues."
             exit 0
-          }
+          }

.github/workflows/skill-scan-report.yml

@@ -1,10 +1,17 @@
 # Runs in the base repository context so it can comment on PRs from forks.
 # Triggered after Build Skill Artifacts completes; downloads scan artifacts
 # and upserts a single "Skill Security Scan Results" PR comment.
+#
+# `workflow_run` is required for that base-repo write access; the trade-off it
+# flags is a privileged workflow trusting event data from an untrusted run.
+# This workflow never checks out or executes the triggering run's code, and
+# the only value it takes from it (the PR number, read from an artifact) is
+# used solely to target the comment, so a bad value means a comment lands on
+# the wrong PR, not privilege escalation.
 name: Skill Scan Report
 
 on:
-  workflow_run:
+  workflow_run:   # zizmor: ignore[dangerous-triggers]
     workflows: ["Build Skill Artifacts"]
     types: [completed]
 

.github/workflows/skill-version-check.yml

@@ -72,8 +72,8 @@ jobs:
     runs-on: ubuntu-latest
     # Only apply the auto-fix for the Renovate bot.
     if: >
-      github.actor == 'renovate[bot]' ||
-      github.actor == 'dependabot[bot]'
+      github.event.pull_request.user.login == 'renovate[bot]' ||
+      github.event.pull_request.user.login == 'dependabot[bot]'
     # No GITHUB_TOKEN access — the push uses a GitHub App installation token
     # (see the "Generate GitHub App token" step below).  Going through the App
     # is required because commits made with the default GITHUB_TOKEN do not
@@ -104,6 +104,9 @@ jobs:
           # Use the head ref directly so we can push to it.
           ref: ${{ github.event.pull_request.head.ref }}
           token: ${{ steps.app-token.outputs.token }}
+          # This job pushes a commit at the end (see "Commit version bumps"
+          # below), so the checkout credential must stay persisted.
+          persist-credentials: true
 
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0