From 8965ae2679d02e2e81970e4aed7c34c01f86f816 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:31:49 -0700
Subject: [PATCH 1/9] ci: remediate zizmor findings

---
 .github/workflows/auto-update-semconv.yml             | 4 ++++
 .github/workflows/build-common.yml                    | 6 +++++-
 .github/workflows/codeql.yml                          | 2 ++
 .github/workflows/fossa.yml                           | 2 ++
 .github/workflows/gradle-wrapper-validation.yml       | 2 ++
 .github/workflows/issue-management-feedback-label.yml | 2 ++
 .github/workflows/prepare-release-branch.yml          | 8 ++++++++
 .github/workflows/release.yml                         | 7 +++++++
 .github/workflows/reusable-lint-check.yml             | 1 +
 9 files changed, 33 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-update-semconv.yml b/.github/workflows/auto-update-semconv.yml
index cc7be61..180331b 100644
--- a/.github/workflows/auto-update-semconv.yml
+++ b/.github/workflows/auto-update-semconv.yml
@@ -18,6 +18,8 @@ jobs:
       already-opened: ${{ steps.check-versions.outputs.already-opened }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - id: check-versions
         name: Check versions
@@ -63,6 +65,7 @@ jobs:
         with:
           # using custom token so the changelog PR link update push triggers workflows
           token: ${{ steps.otelbot-token.outputs.token }}
+          persist-credentials: false
 
       - name: Update version
         env:
@@ -96,6 +99,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Update the semantic conventions version to $VERSION"
           body="Update the semantic conventions version to \`$VERSION\`."
           branch="otelbot/update-semconv-to-${VERSION}"
diff --git a/.github/workflows/build-common.yml b/.github/workflows/build-common.yml
index 7c20b83..f749f19 100644
--- a/.github/workflows/build-common.yml
+++ b/.github/workflows/build-common.yml
@@ -56,6 +56,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - id: setup-java-test
         name: Set up Java ${{ matrix.test-java-version }} for tests
@@ -78,9 +80,11 @@ jobs:
           ./gradlew
           build
           -PtestJavaVersion=${{ matrix.test-java-version }}
-          "-Porg.gradle.java.installations.paths=${{ steps.setup-java-test.outputs.path }},${{ steps.setup-java.outputs.path }}"
+          "-Porg.gradle.java.installations.paths=${STEPS_SETUP_JAVA_TEST_OUTPUTS_PATH},${STEPS_SETUP_JAVA_OUTPUTS_PATH}"
         env:
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          STEPS_SETUP_JAVA_TEST_OUTPUTS_PATH: ${{ steps.setup-java-test.outputs.path }}
+          STEPS_SETUP_JAVA_OUTPUTS_PATH: ${{ steps.setup-java.outputs.path }}
       - name: generate
         # Skip running on macos-latest which doesn't have docker
         if: matrix.os == 'ubuntu-latest'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0c08a08..09dd1d9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,6 +30,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Java 21
         if: matrix.language == 'java'
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index c2593c6..6fa8ed3 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
         with:
diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
index 6252285..6c2dfc7 100644
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ b/.github/workflows/gradle-wrapper-validation.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       # this needs to be in its own workflow in order to make OSSF scorecard happy
       - uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
diff --git a/.github/workflows/issue-management-feedback-label.yml b/.github/workflows/issue-management-feedback-label.yml
index 56664b3..a9b5b4d 100644
--- a/.github/workflows/issue-management-feedback-label.yml
+++ b/.github/workflows/issue-management-feedback-label.yml
@@ -19,6 +19,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Remove labels
         env:
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index c8bf4b8..7c4f21f 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Verify prerequisites
         run: |
@@ -35,9 +37,13 @@ jobs:
           # history is needed to allow fast-forward push below in case
           # re-running this workflow after merging additional PRs to main
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Create release branch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          gh auth setup-git
           version=$(.github/scripts/get-version.sh)
           if [[ $version =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
             release_branch_name="release/v${version}"
@@ -92,6 +98,8 @@ jobs:
       - prereqs
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set environment variables
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 41cbab7..3edcdde 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,6 +29,8 @@ jobs:
           fi
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
         with:
@@ -76,6 +78,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
+          persist-credentials: false
 
       - name: Check that change log update was merged to main
         run: |
@@ -89,6 +92,7 @@ jobs:
         with:
           # tags are needed for the generate-release-contributors.sh script
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Generate release notes
         env:
@@ -138,6 +142,8 @@ jobs:
       # add change log sync (if any) into this PR since the apidiff update
       # is required before any other PR can be merged anyway
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Copy change log section from release branch
         env:
@@ -149,6 +155,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
+          persist-credentials: false
 
       - name: Merge change log to main
         env:
diff --git a/.github/workflows/reusable-lint-check.yml b/.github/workflows/reusable-lint-check.yml
index 495f231..6abbd5e 100644
--- a/.github/workflows/reusable-lint-check.yml
+++ b/.github/workflows/reusable-lint-check.yml
@@ -13,6 +13,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0 # needed for merge-base used in modified-files mode
+          persist-credentials: false
 
       - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
 

From dea2e066d79fdb8e7f0b243da8f0becde00be7c7 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:01:22 -0700
Subject: [PATCH 2/9] ci: preserve authenticated workflow pushes

---
 .github/workflows/build-common.yml           | 1 +
 .github/workflows/prepare-release-branch.yml | 2 ++
 .github/workflows/release.yml                | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/.github/workflows/build-common.yml b/.github/workflows/build-common.yml
index f749f19..7a61111 100644
--- a/.github/workflows/build-common.yml
+++ b/.github/workflows/build-common.yml
@@ -76,6 +76,7 @@ jobs:
       - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
 
       - name: build
+        shell: bash
         run: >
           ./gradlew
           build
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index 7c4f21f..be0c9bc 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -73,6 +73,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against the release branch
@@ -131,6 +132,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Update changelog for $VERSION release"
           body="Update changelog for \`$VERSION\` release."
           branch="otelbot/update-version-to-${VERSION}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3edcdde..27aa551 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -209,6 +209,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against main
@@ -217,6 +218,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Update apidiff baseline to released version $VERSION"
           body="Update apidiff baseline to released version \`$VERSION\`."
           branch="otelbot/update-apidiff-baseline-to-released-version-${VERSION}"

From e53c1affef971ea4431e601d7de740be6268ee94 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:17:38 -0700
Subject: [PATCH 3/9] ci: grant release branch push permission

---
 .github/workflows/prepare-release-branch.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index be0c9bc..bdd0b04 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -125,6 +125,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against main

From d88cd3143df2ba1208e5b63ea06a98f0c8976191 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:48:46 -0700
Subject: [PATCH 4/9] ci: preserve workflow push credentials

---
 .github/workflows/build-common.yml           |  1 -
 .github/workflows/prepare-release-branch.yml | 27 +++++++++++---------
 .github/workflows/release.yml                | 13 +++++-----
 3 files changed, 22 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/build-common.yml b/.github/workflows/build-common.yml
index 7a61111..f749f19 100644
--- a/.github/workflows/build-common.yml
+++ b/.github/workflows/build-common.yml
@@ -76,7 +76,6 @@ jobs:
       - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
 
       - name: build
-        shell: bash
         run: >
           ./gradlew
           build
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index bdd0b04..51b5911 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -73,23 +73,25 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
-          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against the release branch
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Prepare release $VERSION"
           branch="otelbot/prepare-release-${VERSION}"
 
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
-                       --body "$message." \
-                       --base $RELEASE_BRANCH_NAME
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "[$RELEASE_BRANCH_NAME] $message" \
+            --body "$message." \
+            --base $RELEASE_BRANCH_NAME
 
   create-pull-request-against-main:
     permissions:
@@ -125,13 +127,13 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
-          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against main
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
           message="Update changelog for $VERSION release"
@@ -141,6 +143,7 @@ jobs:
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "$message" \
-                       --body "$body" \
-                       --base main
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "$message" \
+            --body "$body" \
+            --base main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 27aa551..51d2f54 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -209,14 +209,14 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
-          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against main
         env:
           VERSION: ${{ needs.release.outputs.version }}
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
           message="Update apidiff baseline to released version $VERSION"
@@ -226,6 +226,7 @@ jobs:
           git checkout -b $branch
           git commit -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "$message" \
-                       --body "$body" \
-                       --base main
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "$message" \
+            --body "$body" \
+            --base main

From 8dd87af81e508c18da4bbd477cbf03e53af84c6d Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 08:04:00 -0700
Subject: [PATCH 5/9] ci: use checkout credentials for git pushes

---
 .github/workflows/auto-update-semconv.yml    |  4 ++--
 .github/workflows/prepare-release-branch.yml | 21 ++++++++------------
 .github/workflows/release.yml                |  9 ++++-----
 3 files changed, 14 insertions(+), 20 deletions(-)

diff --git a/.github/workflows/auto-update-semconv.yml b/.github/workflows/auto-update-semconv.yml
index 180331b..32f14cb 100644
--- a/.github/workflows/auto-update-semconv.yml
+++ b/.github/workflows/auto-update-semconv.yml
@@ -65,7 +65,8 @@ jobs:
         with:
           # using custom token so the changelog PR link update push triggers workflows
           token: ${{ steps.otelbot-token.outputs.token }}
-          persist-credentials: false
+          # zizmor: ignore[artipacked] App credentials are required by the branch pushes below.
+          persist-credentials: true
 
       - name: Update version
         env:
@@ -99,7 +100,6 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
-          gh auth setup-git
           message="Update the semantic conventions version to $VERSION"
           body="Update the semantic conventions version to \`$VERSION\`."
           branch="otelbot/update-semconv-to-${VERSION}"
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index 51b5911..de8d2f5 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -37,13 +37,11 @@ jobs:
           # history is needed to allow fast-forward push below in case
           # re-running this workflow after merging additional PRs to main
           fetch-depth: 0
-          persist-credentials: false
+          # zizmor: ignore[artipacked] Credentials are required by the branch pushes below.
+          persist-credentials: true
 
       - name: Create release branch
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh auth setup-git
           version=$(.github/scripts/get-version.sh)
           if [[ $version =~ ^([0-9]+)\.([0-9]+)\.([0-9]+)$ ]]; then
             release_branch_name="release/v${version}"
@@ -77,18 +75,16 @@ jobs:
 
       - name: Create pull request against the release branch
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # pull requests from secrets.GITHUB_TOKEN do not run workflows
-          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
-          gh auth setup-git
           message="Prepare release $VERSION"
           branch="otelbot/prepare-release-${VERSION}"
 
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+          gh pr create \
             --title "[$RELEASE_BRANCH_NAME] $message" \
             --body "$message." \
             --base $RELEASE_BRANCH_NAME
@@ -102,7 +98,8 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          persist-credentials: false
+          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
+          persist-credentials: true
 
       - name: Set environment variables
         run: |
@@ -131,11 +128,9 @@ jobs:
 
       - name: Create pull request against main
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # pull requests from secrets.GITHUB_TOKEN do not run workflows
-          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
-          gh auth setup-git
           message="Update changelog for $VERSION release"
           body="Update changelog for \`$VERSION\` release."
           branch="otelbot/update-version-to-${VERSION}"
@@ -143,7 +138,7 @@ jobs:
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+          gh pr create \
             --title "$message" \
             --body "$body" \
             --base main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 51d2f54..e69e373 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -78,7 +78,8 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
-          persist-credentials: false
+          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
+          persist-credentials: true
 
       - name: Check that change log update was merged to main
         run: |
@@ -214,11 +215,9 @@ jobs:
       - name: Create pull request against main
         env:
           VERSION: ${{ needs.release.outputs.version }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # pull requests from secrets.GITHUB_TOKEN do not run workflows
-          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
-          gh auth setup-git
           message="Update apidiff baseline to released version $VERSION"
           body="Update apidiff baseline to released version \`$VERSION\`."
           branch="otelbot/update-apidiff-baseline-to-released-version-${VERSION}"
@@ -226,7 +225,7 @@ jobs:
           git checkout -b $branch
           git commit -m "$message"
           git push --set-upstream origin $branch
-          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+          gh pr create \
             --title "$message" \
             --body "$body" \
             --base main

From c119cf3b250462824b4811e8cf81fe700db09777 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 08:32:19 -0700
Subject: [PATCH 6/9] ci: retain credentials on pushed checkout

---
 .github/workflows/release.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e69e373..c26d47b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -78,8 +78,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Check that change log update was merged to main
         run: |
@@ -156,7 +155,8 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
-          persist-credentials: false
+          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
+          persist-credentials: true
 
       - name: Merge change log to main
         env:

From abd26134da3f555df94d5a44441506d238d0a92e Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 09:00:38 -0700
Subject: [PATCH 7/9] ci: use Bash for cross-platform build

---
 .github/workflows/build-common.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/build-common.yml b/.github/workflows/build-common.yml
index f749f19..7a61111 100644
--- a/.github/workflows/build-common.yml
+++ b/.github/workflows/build-common.yml
@@ -76,6 +76,7 @@ jobs:
       - uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
 
       - name: build
+        shell: bash
         run: >
           ./gradlew
           build

From d0ec11cd00b621593b3b8714af5de76b9b2a014b Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 10:28:27 -0700
Subject: [PATCH 8/9] ci: clarify zizmor suppression rationales

---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 09dd1d9..07ebcf8 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,7 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      # This workflow analyzes release branches but does not build or publish release artifacts.
+      # zizmor cache-poisoning suppression rationale: this workflow analyzes release branches but does not build or publish release artifacts.
       - name: Set up gradle # zizmor: ignore[cache-poisoning]
         if: matrix.language == 'java'
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

From 626e3713bbbb2c8f6a30cfa8a75137b87f060253 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 10:41:01 -0700
Subject: [PATCH 9/9] ci: colocate zizmor suppression rationales

---
 .github/workflows/codeql.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 07ebcf8..f84e1a9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,8 +40,9 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      # zizmor cache-poisoning suppression rationale: this workflow analyzes release branches but does not build or publish release artifacts.
-      - name: Set up gradle # zizmor: ignore[cache-poisoning]
+      - name: Set up gradle
+        # zizmor: ignore[cache-poisoning] This workflow analyzes release branches
+        # but does not build or publish release artifacts.
         if: matrix.language == 'java'
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0