Fix the rest of the zizmor findings

.github/workflows/android.yml

@@ -15,6 +15,9 @@ env:
   GITHUB_TOKEN: ${{ github.token }}
   xcodeVersion: "26.2"  # Only affects Mac runners, and only for prerequisites.
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
@@ -29,6 +32,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
       - name: Use expanded matrix
         if: github.event.inputs.use_expanded_matrix == '1'
@@ -93,6 +97,7 @@ jobs:
 
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: true
 
       - name: Set env variables for subsequent steps (all)

.github/workflows/build-report.yml

@@ -31,6 +31,7 @@ jobs:
         python-version: 3.9
     - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
       with:
+        persist-credentials: true # zizmor: ignore[artipacked]
         fetch-depth: 0
     - name: Install Desktop SDK prerequisites
       uses: nick-invision/retry@14672906e672a08bd6eeb15720e9ed3ce869cdd4 # ratchet:nick-invision/retry@v2

.github/workflows/checks.yml

@@ -24,6 +24,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
       - name: Setup python
         uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
@@ -65,6 +66,7 @@ jobs:
           cmakeVersion: "~3.31.0"
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
       - name: Setup python
         uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
@@ -104,6 +106,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
       - name: Run check_copyright.sh
         run: |
@@ -118,6 +121,7 @@ jobs:
         # Skip this if the PR has the skipReleaseNotes label or if it's a merge to other than main.
         if: ${{!contains(github.event.pull_request.labels.*.name, env.skipReleaseNotesLabel) && (github.event.pull_request.base.ref == 'main')}}
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           fetch-depth: 0
           submodules: false
       - name: Check whether release notes have been updated

.github/workflows/checks_secure.yml

@@ -31,6 +31,7 @@ jobs:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         if: steps.check.outputs.has-permission != 1 || github.event.pull_request.head.repo.full_name != github.repository
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
       - name: Setup python
         if: steps.check.outputs.has-permission != 1 || github.event.pull_request.head.repo.full_name != github.repository

.github/workflows/cpp-packaging.yml

@@ -141,6 +141,7 @@ jobs:
         if: ${{ matrix.tools_platform == 'darwin' && !steps.cache_llvm.outputs.cache-hit }}
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           repository: llvm/llvm-project
           path: llvm-src
           ref: ${{ env.llvmVer }}
@@ -163,6 +164,7 @@ jobs:
       - name: fetch demumble
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           repository: nico/demumble
           path: demumble-src
           ref: ${{ env.demumbleVer }}
@@ -211,6 +213,7 @@ jobs:
       - name: fetch SDK
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           path: sdk-src
 
       - name: Setup python
@@ -266,6 +269,7 @@ jobs:
       - name: fetch SDK
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           path: sdk-src
 
       - name: Store git credentials for all git commands
@@ -380,6 +384,7 @@ jobs:
 
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: true
 
       - name: Set env variables for subsequent steps (all)
@@ -523,6 +528,7 @@ jobs:
       - name: fetch SDK
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           path: sdk-src
 
       - name: download packaging-tool artifacts
@@ -733,6 +739,7 @@ jobs:
       - name: fetch SDK
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           path: sdk-src
 
       - name: download artifact
@@ -859,6 +866,8 @@ jobs:
     steps:
     - name: Checkout repo
       uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+        with:
+          persist-credentials: true # zizmor: ignore[artipacked]
 
     - name: Setup python
       uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
@@ -933,6 +942,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
+          with:
+            persist-credentials: true # zizmor: ignore[artipacked]
       - name: Setup python
         uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # ratchet:actions/setup-python@v4
         with:

.github/workflows/desktop.yml

@@ -14,6 +14,9 @@ env:
   CCACHE_DIR: ${{ github.workspace }}/ccache_dir
   GITHUB_TOKEN: ${{ github.token }}
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
@@ -31,6 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
       - name: Use expanded matrix
         if: github.event.inputs.expanded_matrix == '1'
@@ -113,10 +117,13 @@ jobs:
 
       - name: Setup Xcode version (macos)
         if: runner.os == 'macOS'
-        run: sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode_version }}.app/Contents/Developer
+        run: sudo xcode-select -s /Applications/Xcode_${XCODE_VERSION}.app/Contents/Developer
+        env:
+          XCODE_VERSION: ${{ matrix.xcode_version }}
 
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: true
 
       - name: Set env vars (ubuntu)
@@ -327,6 +334,7 @@ jobs:
           cmakeVersion: "~3.31.0"
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
           submodules: true
       - name: Cache vcpkg C++ dependencies

.github/workflows/integration_tests.yml

@@ -155,6 +155,7 @@ jobs:
         access_token: ${{ github.token }}
     - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
       with:
+        persist-credentials: true # zizmor: ignore[artipacked]
         ref: ${{steps.set_outputs.outputs.github_ref}}
         fetch-depth: 0
         submodules: false
@@ -309,6 +310,7 @@ jobs:
           cmakeVersion: "~3.31.0"
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
           submodules: true
       - name: Setup python
@@ -482,6 +484,7 @@ jobs:
           cmakeVersion: "~3.31.0"
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
           submodules: true
       - run: df -h
@@ -626,6 +629,7 @@ jobs:
           cmakeVersion: "~3.31.0"
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
           submodules: true
       - name: Setup python
@@ -748,6 +752,7 @@ jobs:
           cmakeVersion: "~3.31.0"
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
           submodules: true
       - name: Setup python
@@ -888,6 +893,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Download Desktop integration tests artifact
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
@@ -1018,6 +1024,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Download Android integration tests artifact
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
@@ -1163,6 +1170,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Download iOS integration tests artifact
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
@@ -1348,6 +1356,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Download tvOS integration tests artifact
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
@@ -1496,6 +1505,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
 
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Setup python
@@ -1576,6 +1586,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
 
           ref: ${{needs.check_and_prepare.outputs.github_ref}}
       - name: Setup python

.github/workflows/ios.yml

@@ -13,6 +13,9 @@ on:
 env:
   GITHUB_TOKEN: ${{ github.token }}
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
@@ -25,6 +28,7 @@ jobs:
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
       - name: Use expanded matrix
         if: github.event.inputs.use_expanded_matrix == '1'
@@ -56,10 +60,13 @@ jobs:
 
       - name: setup Xcode version (macos)
         if: runner.os == 'macOS'
-        run: sudo xcode-select -s /Applications/Xcode_${{ matrix.xcode_version }}.app/Contents/Developer
+        run: sudo xcode-select -s /Applications/Xcode_${XCODE_VERSION}.app/Contents/Developer
+        env:
+          XCODE_VERSION: ${{ matrix.xcode_version }}
 
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: true
 
       - name: Setup python

.github/workflows/lint.yml

@@ -4,21 +4,29 @@ on:
   pull_request:
     types: [opened,synchronize]
 
+permissions:
+  contents: read
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
 jobs:
   lint_warnings_check_and_comment:
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           repository: cpplint/cpplint
           ref: "1.5.5"
           path: cpplint
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           submodules: false
           path: firebase
 

.github/workflows/retry-test-failures.yml

@@ -7,6 +7,9 @@ on:
         default: ''
         required: true
 
+permissions:
+  contents: read
+
 jobs:
   check_results_and_retry_if_needed:
     name: check-results-and-retry-if-needed
@@ -27,6 +30,7 @@ jobs:
 
       - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           ref: ${{ matrix.branch_name }}
           fetch-depth: 0
           submodules: false

.github/workflows/reviewer-roulette.yml

@@ -7,10 +7,16 @@ on:
 env:
   reviewerList: "jonsimantov a-maurice cynthiajoan chkuang-g AlmostMatt"
 
+permissions:
+  contents: read
+
 jobs:
   assign_random_reviewer:
     if: github.event.action == 'labeled' && github.event.label.name == 'reviewer-roulette'
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Unset label
         uses: buildsville/add-remove-label@6008d7bd99d3baeb7c04033584e68f8ec80b198b # ratchet:buildsville/add-remove-label@v1

.github/workflows/update-custom-runner.yml

@@ -19,6 +19,9 @@ on:
 env:
   GITHUB_TOKEN: ${{ github.token }}
 
+permissions:
+  contents: read
+
 jobs:
   update_custom_runners:
     name: update-custom-runner-${{ matrix.runner_hostname }}

.github/workflows/update-dependencies.yml

@@ -46,6 +46,7 @@
       - name: Check out base branch
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # ratchet:actions/checkout@v3
         with:
+          persist-credentials: true # zizmor: ignore[artipacked]
           fetch-depth: 0
           ref: ${{ github.event.inputs.baseBranch }}
 
@@ -228,7 +229,7 @@
           GITHUB_EVENT_INPUTS_BASEBRANCH: ${{ github.event.inputs.baseBranch }}
 
       - name: Set test trigger label.
         uses: actions-ecosystem/action-add-labels@18f1af5e3544586314bbe15c0273249c770b2daf # ratchet:actions-ecosystem/action-add-labels@v1
         if: ${{ github.event.inputs.triggerTests == 1 && steps.push-branch.outputs.branch_pushed == 1 }}
         with:
           github_token: ${{ steps.generate-token.outputs.token }}