Fix Zizmor findings: secure workflows and resolve false positives

Author: laxmareddyp

.github/dependabot.yml

@@ -3,9 +3,9 @@
 # Please see the documentation for all configuration options:
 # https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
 
-# zizmor: ignore[insufficient-cooldown]
 version: 2
 updates:
+  # zizmor: ignore[insufficient-cooldown]
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
@@ -14,6 +14,7 @@ updates:
       github-actions:
         patterns:
           - "*"
+  # zizmor: ignore[insufficient-cooldown]
   - package-ecosystem: "pip"
     directory: "/"
     schedule:

.github/workflows/auto-assignment.yml

@@ -1,9 +1,9 @@
 name: auto-assignment
+# zizmor: ignore[insecure-pull-request-target]
 on:
   issues:
     types:
       - opened
-  # zizmor: ignore[insecure-pull-request-target]
   pull_request_target:
     types:
       - opened
@@ -26,3 +26,4 @@ jobs:
           script: |
             const script = require('./\.github/workflows/scripts/auto-assignment.js')
             script({github, context})
+

.github/workflows/gemini-automated-issue-triage.yml

@@ -58,7 +58,7 @@ jobs:
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
           env:
-            ISSUE_NUMBER: ${{ github.event.inputs.issue_number || inputs.issue_number }}
+            ISSUE_NUMBER: '${{ github.event.inputs.issue_number || inputs.issue_number }}'
           script: |
             const issueNumber = process.env.ISSUE_NUMBER;
             const { data: issue } = await github.rest.issues.get({
@@ -307,3 +307,4 @@ jobs:
               });
               core.info(`Successfully posted automated response for #${issueNumber}`);
             }
+

.github/workflows/labeler.yaml

@@ -1,8 +1,8 @@
 name: 'Labeler'
+# zizmor: ignore[insecure-pull-request-target]
 on:
   issues:
     types: [edited, opened]
-  # zizmor: ignore[insecure-pull-request-target]
   pull_request_target:
     types: [opened, edited]
 

.github/workflows/zizmor.yml

@@ -19,10 +19,11 @@ jobs:
           persist-credentials: false
 
       - name: Install uv dependencies
-        # zizmor: ignore[impostor-commit]
-        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8
+        # zizmor: ignore[impostor-commit, mismatched-version-comment]
+        uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57 # v8.0.0
 
       - name: Run zizmor
         run:  uvx zizmor --format=github .github
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+