ci: remediate zizmor findings

.github/aw/actions-lock.json

@@ -10,6 +10,11 @@
       "version": "v6.0.2",
       "sha": "de0fac2e4500dabe0009e67214ff5f5447ce83dd"
     },
+    "actions/create-github-app-token@v3.2.0": {
+      "repo": "actions/create-github-app-token",
+      "version": "v3.2.0",
+      "sha": "bcd2ba49218906704ab6c1aa796996da409d3eb1"
+    },
     "actions/download-artifact@v5": {
       "repo": "actions/download-artifact",
       "version": "v5",

.github/workflows/auto-license-report.yml

@@ -16,6 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh
@@ -80,14 +82,18 @@ jobs:
         if: steps.check-patch.outputs.exists == 'true'
         with:
           token: ${{ steps.otelbot-token.outputs.token }}
+          persist-credentials: false
 
       - name: Use CLA approved bot
         if: steps.check-patch.outputs.exists == 'true'
         run: .github/scripts/use-cla-approved-bot.sh
 
       - name: Apply patch and push
         if: steps.check-patch.outputs.exists == 'true'
+        env:
+          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           git apply "${{ runner.temp }}/patch"
           git add licenses
           git commit -m "Update license report"

.github/workflows/auto-update-otel-sdk.yml

@@ -18,6 +18,8 @@ jobs:
       already-opened: ${{ steps.check-versions.outputs.already-opened }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - id: check-versions
         name: Check versions
@@ -56,6 +58,8 @@ jobs:
       - check-versions
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Update version
         env:
@@ -96,9 +100,11 @@ jobs:
         if: success() || failure()
         env:
           VERSION: ${{ needs.check-versions.outputs.latest-version }}
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Update the OpenTelemetry SDK version to $VERSION"
           body="Update the OpenTelemetry SDK version to \`$VERSION\`."
           branch="otelbot/update-opentelemetry-sdk-to-${VERSION}"
@@ -108,9 +114,10 @@ jobs:
           git add licenses
           git commit -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "$message" \
-                       --body "$body" \
-                       --base main
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "$message" \
+            --body "$body" \
+            --base main
 
   workflow-notification:
     permissions:

.github/workflows/backport.yml

@@ -25,6 +25,7 @@ jobs:
         with:
           # history is needed to run git cherry-pick below
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Use CLA approved bot
         run: .github/scripts/use-cla-approved-bot.sh
@@ -39,11 +40,13 @@ jobs:
       - name: Create pull request
         env:
           NUMBER: ${{ github.event.inputs.number }}
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
-          commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
-          title=$(gh pr view $NUMBER --json title --jq .title)
+          gh auth setup-git
+          commit=$(GH_TOKEN="$OTELBOT_TOKEN" gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
+          title=$(GH_TOKEN="$OTELBOT_TOKEN" gh pr view $NUMBER --json title --jq .title)
 
           branch="otelbot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}"
 
@@ -57,6 +60,7 @@ jobs:
           # so for now at least PRs that update workflow files need to be backported manually
           git push --set-upstream origin $branch
 
-          gh pr create --title "[$GITHUB_REF_NAME] $title" \
-                       --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
-                       --base $GITHUB_REF_NAME
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "[$GITHUB_REF_NAME] $title" \
+            --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
+            --base $GITHUB_REF_NAME

.github/workflows/build-common.yml

@@ -27,6 +27,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh
@@ -51,6 +53,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh
@@ -92,6 +96,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh
@@ -131,6 +137,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Dependency check
         run: |
@@ -155,20 +163,26 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - run: .github/scripts/check-javaagent-suppression-keys.sh
 
   check-latest-dep-test-overrides:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - run: .github/scripts/check-latest-dep-test-overrides.sh
 
   check-package-names:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - run: .github/scripts/check-package-names.sh
 
@@ -212,6 +226,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh
@@ -301,6 +317,8 @@ jobs:
       fail-fast: false
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh
@@ -351,20 +369,21 @@ jobs:
 
       - name: Set test tasks
         run: |
-          echo "test-tasks=$(cat test-tasks.txt | xargs echo | sed 's/\n/ /g')" >> $GITHUB_ENV
+          echo "test_tasks=$(cat test-tasks.txt | xargs echo | sed 's/\n/ /g')" >> $GITHUB_ENV
 
       - name: Test
         env:
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          STEPS_SETUP_TEST_JAVA_OUTPUTS_PATH: ${{ steps.setup-test-java.outputs.path }}
         # spotless is checked separately since it's a common source of failure
         run: >
           ./gradlew
-          ${{ env.test-tasks }}
+          ${test_tasks}
           -PtestJavaVersion=${{ matrix.test-java-version }}
           -PtestJavaVM=${{ matrix.vm }}
           -PtestIndy=${{ matrix.test-indy }}
           -PdenyUnsafe=${{ matrix.test-java-version == '25-deny-unsafe' && 'true' || 'false' }}
-          -Porg.gradle.java.installations.paths=${{ steps.setup-test-java.outputs.path }}
+          -Porg.gradle.java.installations.paths=${STEPS_SETUP_TEST_JAVA_OUTPUTS_PATH}
           -Porg.gradle.java.installations.auto-download=false
           ${{ inputs.no-build-cache && ' --no-build-cache' || '' }}
 
@@ -420,6 +439,8 @@ jobs:
         if: matrix.os == 'windows-latest'
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh
@@ -490,6 +511,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh
@@ -513,6 +536,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh

.github/workflows/build-daily.yml

@@ -33,6 +33,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh

.github/workflows/codeql.yml

@@ -35,6 +35,8 @@ jobs:
     runs-on: ${{ github.repository == 'open-telemetry/opentelemetry-java-instrumentation' && 'oracle-vm-8cpu-32gb-x86-64' || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       # don't need to free disk space (which takes time) since running on larger machine
 

.github/workflows/copilot-setup-steps.yml

@@ -11,6 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh

.github/workflows/dependency-review.yml

@@ -18,5 +18,7 @@ jobs:
     steps:
       - name: 'Checkout Repository'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/documentation-synchronization-audit.yml

@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
         with:

.github/workflows/draft-release-notes.yml

@@ -22,6 +22,7 @@ jobs:
           # need full history and tags so the release-notes script can resolve
           # the previous release tag (e.g. v2.27.0) when computing the commit range
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Install Copilot CLI
         run: |
@@ -55,9 +56,11 @@ jobs:
       - name: Create pull request against main
         env:
           ARTIFACT_URL: ${{ steps.upload-diagnostics.outputs.artifact-url }}
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Draft release notes"
           body=$(cat <<EOF
           Automated draft of the \`## Unreleased\` section of \`CHANGELOG.md\`.
@@ -73,6 +76,7 @@ jobs:
           git add CHANGELOG.md
           git commit -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "$message" \
-                       --body "$body" \
-                       --base main
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "$message" \
+            --body "$body" \
+            --base main

.github/workflows/flaky-test-remediation.yml

@@ -24,6 +24,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0  # need history to detect recently-modified files
+          persist-credentials: false
 
       - name: Fetch progress branch
         run: git fetch origin otelbot/flaky-test-remediation-progress
@@ -78,6 +79,8 @@ jobs:
       OUT_DIR: build/flaky-test-remediation
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Free disk space
         run: .github/scripts/gha-free-disk-space.sh
@@ -158,7 +161,12 @@ jobs:
 
       - name: Push branch
         if: steps.changes.outputs.committed == 'true'
-        run: git push -f origin "${{ steps.branch.outputs.name }}"
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STEPS_BRANCH_OUTPUTS_NAME: ${{ steps.branch.outputs.name }}
+        run: |
+          gh auth setup-git
+          git push -f origin "${STEPS_BRANCH_OUTPUTS_NAME}"
 
       - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: otelbot-token
@@ -183,6 +191,7 @@ jobs:
         with:
           ref: otelbot/flaky-test-remediation-progress
           path: progress
+          persist-credentials: false
 
       - name: Use CLA approved bot
         if: steps.changes.outputs.committed == 'true'
@@ -193,7 +202,10 @@ jobs:
       - name: Record attempt
         if: steps.changes.outputs.committed == 'true'
         working-directory: progress
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          gh auth setup-git
           if grep -Fxq "$TEST_CLASS" attempted.txt; then
             echo "$TEST_CLASS already recorded"
           else

.github/workflows/fossa.yml

@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
         with: