ci: enforce pedantic zizmor GitHub Actions security analysis

.github/workflows/assign-reviewers.yml

@@ -8,12 +8,19 @@ on:
     types: [opened, ready_for_review, reopened, synchronize]
 
 permissions:
-  pull-requests: write
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   assign-reviewers:
+    name: assign-reviewers
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write # Required to add requested reviewers and teams to pull requests
+      contents: read
     if: github.event.pull_request.draft == false
     steps:
       - name: Assign Reviewers

.github/workflows/codeql-autogenerated.yml

@@ -10,24 +10,22 @@ on:
   schedule:
     - cron: '0 2 * * *'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
     # Runner size impacts CodeQL analysis time. To learn more, please see:
     #   - https://gh.io/recommended-hardware-resources-for-running-codeql
     #   - https://gh.io/supported-runners-and-hardware-resources
     #   - https://gh.io/using-larger-runners (GitHub.com only)
-    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ubuntu-latest
     permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
+      security-events: write # required for all workflows
+      packages: read # required to fetch internal or private CodeQL packs
+      actions: read # only required for workflows in private repositories
       contents: read
 
     strategy:
@@ -50,7 +48,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         persist-credentials: false
 
@@ -62,10 +60,10 @@ jobs:
 
     # Initializes the CodeQL tools for scanning - autogen flavour.
     - name: Initialize CodeQL for autogenerated
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       with:
         config-file: .github/codeql/codeql-autogenerated.yml
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
     - name: Perform CodeQL Analysis for autogenerated
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/codeql-handwritten.yml

@@ -10,6 +10,10 @@ on:
   schedule:
     - cron: '30 1 * * *'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -20,16 +24,10 @@ jobs:
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ubuntu-latest
     permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
+      security-events: write # required for all workflows
+      packages: read # required to fetch internal or private CodeQL packs
+      actions: read # only required for workflows in private repositories
       contents: read
-
     strategy:
       fail-fast: false
       matrix:
@@ -50,7 +48,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         persist-credentials: false
 
@@ -62,10 +60,10 @@ jobs:
 
     # Initializes the CodeQL tools for scanning - handwritten flavour.
     - name: Initialize CodeQL for handwritten
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       with:
         config-file: .github/codeql/codeql-handwritten.yml
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
     - name: Perform CodeQL Analysis for handwritten
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/codeql-repo.yml

@@ -10,6 +10,10 @@ on:
   schedule:
     - cron: '0 1 * * *'
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -20,16 +24,10 @@ jobs:
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ubuntu-latest
     permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
+      security-events: write # required for all workflows
+      packages: read # required to fetch internal or private CodeQL packs
+      actions: read # only required for workflows in private repositories
       contents: read
-
     strategy:
       fail-fast: false
       matrix:
@@ -50,7 +48,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         persist-credentials: false
 
@@ -62,11 +60,11 @@ jobs:
 
     # Initializes the CodeQL tools for scanning - repo meta flavour.
     - name: Initialize CodeQL for repo meta
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
       with:
         config-file: .github/codeql/codeql-repo.yml
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
 
     - name: Perform CodeQL Analysis for repo meta
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2

.github/workflows/conformance-test.yaml

@@ -11,14 +11,19 @@ on:
     paths:
       - 'handwritten/storage/**'
 name: conformance
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   conformance-test:
+    name: conformance-test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 14
       - run: node --version

.github/workflows/conformance.yaml

@@ -26,8 +26,13 @@ on:
     paths:
     - 'handwritten/bigtable/**'
 name: conformance
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   conformance:
+    name: conformance
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -36,16 +41,16 @@ jobs:
       matrix:
         node: [ 18, 20 ]
     steps:
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         persist-credentials: false
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         repository: googleapis/cloud-bigtable-clients-test
         ref: main
         path: handwritten/bigtable/cloud-bigtable-clients-test
         persist-credentials: false
-    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: ${{ matrix.node }}
     - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5

.github/workflows/continuous.yaml

@@ -6,8 +6,13 @@ on:
     branches:
       - main
 name: continuous
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   units:
+    name: units
     runs-on: ubuntu-latest
     strategy:
       matrix:

.github/workflows/discovery.yaml

@@ -6,9 +6,15 @@ on:
     - cron: '0 12 * * TUE'
   workflow_dispatch:
 name: Update Discovery Generated Types
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   sync:
+    name: sync
     runs-on: ubuntu-latest
+    environment: discovery
     steps:
       - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:

.github/workflows/generator-tests.yaml

@@ -15,13 +15,19 @@ on:
       - '.github/workflows/generator-tests.yaml'
   workflow_dispatch:
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   presubmit:
+    name: presubmit
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
-    container: gcr.io/gapic-images/googleapis:20250404
+    environment: presubmit
+    container: gcr.io/gapic-images/googleapis@sha256:cd3f791dfc4267f522ed0714d95e0b5c64741c69cbeb732dbf99078813d63ade # 20250404
     steps:
-    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       with:
         fetch-depth: 300
         persist-credentials: false
@@ -37,7 +43,7 @@ jobs:
         key: ${{ runner.os }}-googleapis-20250422-${{ secrets.CACHE_VERSION }}
 
     - name: Setup Node.js
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: 24.x
 

.github/workflows/issues-no-repro.yaml

@@ -6,17 +6,22 @@ on:
   issues:
     types: [opened, reopened]
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   close:
+    name: close
     runs-on: ubuntu-latest
     permissions:
-      issues: write
-      pull-requests: write
+      issues: write # Required to comment on and close issues with invalid reproduction links
+      pull-requests: write # Required to comment on and close pull requests with invalid reproduction links
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 18
       - run: npm install

.github/workflows/mandatory-conformance.yaml

@@ -26,8 +26,13 @@ on:
     paths:
     - 'handwritten/bigtable/**'
 name: mandatory-conformance
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   mandatory-conformance:
+    name: mandatory-conformance
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -36,16 +41,16 @@ jobs:
       matrix:
         node: [ 18, 20 ]
     steps:
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         persist-credentials: false
-    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         repository: googleapis/cloud-bigtable-clients-test
         ref: v0.0.3
         path: handwritten/bigtable/cloud-bigtable-clients-test
         persist-credentials: false
-    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+    - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: ${{ matrix.node }}
     - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5

.github/workflows/presubmit.yaml

@@ -4,8 +4,13 @@ permissions:
 on:
   pull_request:
 name: presubmit
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   units:
+    name: units
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -29,6 +34,7 @@ jobs:
           BUILD_TYPE: presubmit
           TEST_TYPE: units
   lint:
+    name: lint
     runs-on: ubuntu-latest
     continue-on-error: true
     steps: