ci: remediate zizmor findings

[opentelemetrybot]

Tracked in open-telemetry/sig-security#293.

Resolves existing findings from the OpenTelemetry shared workflow.

The workflow:

• runs the regular persona on pull requests, pushes to main, release/*, and a randomized weekly schedule;
• uploads results to GitHub code scanning;
• uses the shared workflow pinned to an immutable commit.

Zizmor remediation

This change also resolves findings from these zizmor rules:

• artipacked
• cache-poisoning
• dangerous-triggers
• github-app
• template-injection

After merge

1. Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
2. Mark the corresponding admin PR ready for review and merge it to require zizmor code scanning.
3. On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Waiting on maintainers · refreshed 2026-07-31 22:16 UTC

Merge when ready.

Status above doesn't look right?

• Just replied or pushed? Anything around or after the refresh time above may not be picked up yet — give it a few minutes.
• Anything look wrong? Report it with what you expected; it helps us improve the dashboard.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.48%. Comparing base (f8bd413) to head (72e9836).

Additional details and impacted files

@@            Coverage Diff            @@
##               main    #8592   +/-   ##
=========================================
  Coverage     91.48%   91.48%           
  Complexity    10467    10467           
=========================================
  Files          1021     1021           
  Lines         27694    27694           
  Branches       3247     3247           
=========================================
  Hits          25337    25337           
  Misses         1615     1615           
  Partials        742      742           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR adds and hardens GitHub Actions workflows to remediate Zizmor findings (including credential persistence, cache-poisoning, dangerous triggers, and GitHub App token permission scoping), and introduces a dedicated Zizmor workflow that uploads SARIF results to code scanning.

Changes:

• Add a repository zizmor workflow using the OpenTelemetry shared workflow pinned to an immutable commit and with least-privilege permissions.
• Reduce credential exposure by setting persist-credentials: false on actions/checkout across multiple workflows.
• Apply targeted Zizmor remediations (explicit GitHub App token permissions, zizmor: ignore[...] annotations where appropriate, and safer env usage in build commands).

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
.github/workflows/zizmor.yml	New Zizmor workflow wired for PR/push/schedule with SARIF upload permissions and pinned reusable workflow.
.github/workflows/sonatype-guide-dependency-audit-daily.yml	Disable persisted checkout credentials.
.github/workflows/reusable-link-check.yml	Disable persisted checkout credentials.
.github/workflows/release.yml	Disable persisted checkout credentials; tighten GitHub App token permissions; configure git auth for post-release pushes.
.github/workflows/prepare-release-branch.yml	Disable persisted checkout credentials; adjust git auth/token permissions for branch/PR automation.
.github/workflows/prepare-patch-release.yml	Disable persisted checkout credentials; adjust GitHub App token permissions for PR automation.
.github/workflows/javadoc-crawler.yml	Disable persisted checkout credentials.
.github/workflows/issue-management-feedback-label.yml	Disable persisted checkout credentials.
.github/workflows/gradle-wrapper-validation.yml	Disable persisted checkout credentials.
.github/workflows/fossa.yml	Disable persisted checkout credentials.
.github/workflows/detect-api-changes.yml	Document and annotate pull_request_target usage; scope GitHub App token permissions.
.github/workflows/codeql.yml	Disable persisted checkout credentials; annotate gradle setup for Zizmor cache-poisoning rule.
.github/workflows/build.yml	Disable persisted checkout credentials; annotate gradle setup; move expression-derived path into env to avoid template-injection concerns.
.github/workflows/build-tracecontext-testsuite.yml	Disable persisted checkout credentials.
.github/workflows/build-daily.yml	Disable persisted checkout credentials.
.github/workflows/benchmark.yml	Disable persisted checkout credentials.
.github/workflows/benchmark-tags.yml	Disable persisted checkout credentials.
.github/workflows/backport.yml	Disable persisted checkout credentials; scope GitHub App token permissions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

.github/workflows/prepare-release-branch.yml:78

• In create-pull-request-against-release-branch, the workflow now requests an app token with permission-contents: write, but the subsequent step that does git push --set-upstream origin $branch does not re-run gh auth setup-git after switching GH_TOKEN to the app token. With persist-credentials: false, this makes the push rely on whatever git auth state was configured earlier in the job (currently set up using secrets.GITHUB_TOKEN), which can lead to pushes being attributed to GITHUB_TOKEN (and potentially not triggering downstream workflows). Configure git auth in the PR-creation step itself so the push definitely uses the app token.

        with:
          client-id: ${{ vars.OTELBOT_CLIENT_ID }}
          private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
          permission-contents: write
          permission-pull-requests: write

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

[trask]

cc @trask to review first

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated no new comments.

[trask]

LGTM, but you could wait until we merge similar in other Java repos and go through release to verify

[Copilot]

Pull request overview

Copilot reviewed 19 out of 19 changed files in this pull request and generated no new comments.

[trask]

LGTM, but you could wait until we merge similar in other Java repos and go through release to verify

oh, wait, we haven't gone through release yet in other repos...