fix zizmor findings (#10044)

* don't persist unused credentials

* fix zizmor findings

* remove one persistence

.github/workflows/check-changeset.yml

@@ -37,6 +37,7 @@ jobs:
       with:
         # This makes Actions fetch all Git history so check_changeset script can diff properly.
         fetch-depth: 0
+        persist-credentials: false
     - name: Set up Node (22)
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
       with:

.github/workflows/check-docs.yml

@@ -16,6 +16,9 @@ name: Doc Change Check (Run "yarn docgen:all" if this fails)
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   doc-check:
     name: Check if reference docs have changed
@@ -27,6 +30,7 @@ jobs:
         with:
           # get all history for the diff
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Node (22)
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
         with:

.github/workflows/check-pkg-paths.yml

@@ -16,6 +16,9 @@ name: Test Package Paths
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Test Package Paths
@@ -27,6 +30,7 @@ jobs:
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
+        persist-credentials: false
     - name: Set up Node (22)
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
       with:
@@ -38,4 +42,4 @@ jobs:
     - name: Swap in public typings
       run: yarn release:prepare
     - name: Check paths
-      run: yarn ts-node scripts/ci-test/check-paths.ts
+      run: yarn ts-node scripts/ci-test/check-paths.ts

.github/workflows/check-vertexai-responses.yml

@@ -28,6 +28,8 @@ jobs:
       pull-requests: write
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Clone mock responses
         run: scripts/update_vertexai_responses.sh
       - name: Find cloned and latest versions
@@ -64,5 +66,7 @@ jobs:
             github.rest.issues.deleteComment({
                     owner: context.repo.owner,
                     repo: context.repo.repo,
-                    comment_id: ${{ steps.fc.outputs.comment-id }},
+                    comment_id: Number(process.env.COMMENT_ID),
             })
+        env:
+          COMMENT_ID: ${{ steps.fc.outputs.comment-id }}

.github/workflows/deploy-config.yml

@@ -16,6 +16,9 @@ name: Deploy Project Config
 
 on: pull_request
 
+permissions:
+  contents: read
+
 # Detects if any project config files (rules or functions) have changed,
 # and deploys them to the test project used for CI if so.
 # Run this in its own workflow instead of as a step before each test
@@ -35,6 +38,7 @@ jobs:
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
+        persist-credentials: false
     - name: Set up node (22)
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
       with:

.github/workflows/e2e-test.yml

@@ -23,6 +23,9 @@ env:
   # Bump Node memory limit
   NODE_OPTIONS: "--max_old_space_size=4096"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Run E2E Smoke Tests
@@ -36,6 +39,8 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up Node (22)
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
         with:

.github/workflows/format.yml

@@ -20,6 +20,9 @@ env:
   GITHUB_PULL_REQUEST_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
   GITHUB_PULL_REQUEST_BASE_SHA: ${{ github.event.pull_request.base.sha }}
 
+permissions:
+  contents: read
+
 jobs:
   format:
     name: Run license and prettier formatting tasks
@@ -31,6 +34,7 @@ jobs:
       with:
         # get all history for the diff
         fetch-depth: 0
+        persist-credentials: false
     - name: Set up node (22)
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
       with:
@@ -43,4 +47,4 @@ jobs:
       run: git diff --exit-code
     - name: Formatting needs to be updated. See message below.
       if: ${{ failure() }}
-      run: echo "Something was changed by formatting. Run \`yarn format\` locally to do a prettier/license pass. Use \`yarn format --help\` to see options."
+      run: echo "Something was changed by formatting. Run \`yarn format\` locally to do a prettier/license pass. Use \`yarn format --help\` to see options."

.github/workflows/lint.yml

@@ -16,6 +16,9 @@ name: Lint All Packages
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   test:
     name: Lint
@@ -23,6 +26,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Set up node (22)
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
       with:

.github/workflows/prerelease-manual-deploy.yml

@@ -23,6 +23,9 @@ on:
             npmTag:
                 description: 'The npm tag to publish to, as in npm install firebase@<npmTag>'
                 required: true
+permissions:
+  contents: read
+
 jobs:
     deploy:
         environment: release
@@ -35,6 +38,7 @@ jobs:
           with:
             # Canary release script requires git history and tags.
             fetch-depth: 0
+            persist-credentials: false
         - name: Set up node (22)
           uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
           with:

.github/workflows/release-log.yml

@@ -20,6 +20,9 @@ on:
       - release
       - '*-releasebranch'
 
+permissions:
+  contents: read
+
 jobs:
   release:
     name: Send PR number to tracker endpoint
@@ -27,6 +30,8 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js 20.x
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4

.github/workflows/release-pr.yml

@@ -35,6 +35,7 @@ jobs:
         with:
           # This makes Actions fetch all Git history so that Changesets can generate changelogs with the correct commits
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Node.js 20.x
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4

.github/workflows/release-prod.yml

@@ -44,6 +44,8 @@ jobs:
         fetch-depth: 0
         ref: ${{ github.event.inputs.release-branch }}
         token: ${{ secrets.OSS_BOT_GITHUB_TOKEN }}
+        # This is ok since this workflow uses a custom token.
+        persist-credentials: false
     - name: Yarn install
       run: yarn
     - name: Publish to NPM

.github/workflows/release-staging.yml

@@ -14,6 +14,9 @@
 
 name: Staging Release
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
     inputs:
@@ -60,16 +63,20 @@ jobs:
           const result = await github.rest.repos.merge({
             owner: context.repo.owner,
             repo: context.repo.repo,
-            base: '${{ github.event.inputs.release-branch }}',
-            head: '${{ github.event.inputs.source-branch }}'
+            base: process.env.RELEASE_BRANCH,
+            head: process.env.SOURCE_BRANCH
           })
           console.log(result)
+      env:
+        RELEASE_BRANCH: ${{ github.event.inputs.release-branch }}
+        SOURCE_BRANCH: ${{ github.event.inputs.source-branch }}
     - name: Checkout current branch (with history)
       uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
       with:
         # Release script requires git history and tags.
         fetch-depth: 0
         ref: ${{ github.event.inputs.release-branch }}
+        persist-credentials: false
     - name: Yarn install
       run: yarn
     - name: Publish to NPM

.github/workflows/test-all.yml

@@ -47,6 +47,8 @@ jobs:
       run: |
         npx @puppeteer/browsers install chrome@stable
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Set up Node (22)
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
       with:
@@ -81,6 +83,8 @@ jobs:
       run: |
         npx @puppeteer/browsers install chrome@stable
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Download build archive
       uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
       with:
@@ -145,6 +149,8 @@ jobs:
         echo "::warning ::Previously validated version: ${CHROME_VALIDATED_VERSION} vs. Installed version: $chromeVersionString"
         fi
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Download build archive
       uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
       with:
@@ -195,6 +201,8 @@ jobs:
       run: |
         npx @puppeteer/browsers install chrome@stable
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Download build archive
       uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
       with:
@@ -248,6 +256,8 @@ jobs:
       run: |
         npx @puppeteer/browsers install chrome@stable
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Download build archive
       uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # ratchet:actions/download-artifact@v4
       with:

.github/workflows/test-changed-auth.yml

@@ -16,6 +16,9 @@ name: Test Auth
 
 on: pull_request
 
+permissions:
+  contents: read
+
 env:
   # make chromedriver detect installed Chrome version and download the corresponding driver
   DETECT_CHROMEDRIVER_VERSION: true
@@ -56,6 +59,7 @@ jobs:
         with:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Node (22)
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
         with:
@@ -81,6 +85,7 @@ jobs:
         with:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Node (22)
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
         with:
@@ -105,6 +110,7 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Node (22)
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
         with:
@@ -119,4 +125,4 @@ jobs:
       - name: Run tests on changed packages
         run: yarn test:changed auth
         env:
-          BROWSERS: 'WebkitHeadless'
+          BROWSERS: 'WebkitHeadless'

.github/workflows/test-changed-fcm-integration.yml

@@ -16,6 +16,9 @@ name: Test FCM integration
 
 on: pull_request
 
+permissions:
+  contents: read
+
 env:
   # make chromedriver detect installed Chrome version and download the corresponding driver
   DETECT_CHROMEDRIVER_VERSION: true
@@ -38,6 +41,7 @@ jobs:
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
+        persist-credentials: false
     - name: Set up Node (22)
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
       with:

.github/workflows/test-changed-firestore-integration.yml

@@ -16,6 +16,9 @@ name: Test Firestore Integration
 
 on: pull_request
 
+permissions:
+  contents: read
+
 env:
   # Bump Node memory limit
   NODE_OPTIONS: "--max_old_space_size=4096"
@@ -33,6 +36,7 @@ jobs:
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
+        persist-credentials: false
     # This commit represents v0.8.3
     - uses: 'google-github-actions/auth@fc2174804b84f912b1f6d334e9463f484f1c552d'
       if: ${{ fromJSON(env.run_terraform_steps) }}

.github/workflows/test-changed-firestore.yml

@@ -18,6 +18,9 @@ on:
   workflow_dispatch:
   pull_request:
 
+permissions:
+  contents: read
+
 env:
   artifactRetentionDays: 14
   # Bump Node memory limit
@@ -37,6 +40,7 @@ jobs:
         with:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Node (22)
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
         with:
@@ -287,4 +291,4 @@ jobs:
     steps:
       - name: Check test matrix
         if: needs.build.result == 'failure' || needs.test-chrome.result == 'failure' || needs.compat-test-chrome.result == 'failure'
-        run: exit 1
+        run: exit 1

.github/workflows/test-changed-misc.yml

@@ -16,6 +16,9 @@ name: Test @firebase/rules-unit-testing
 
 on: pull_request
 
+permissions:
+  contents: read
+
 env:
   # Bump Node memory limit
   NODE_OPTIONS: "--max_old_space_size=4096"
@@ -31,6 +34,7 @@ jobs:
       with:
         # This makes Actions fetch all Git history so run-changed script can diff properly.
         fetch-depth: 0
+        persist-credentials: false
     - name: Set up Node (22)
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
       with:
@@ -48,4 +52,4 @@ jobs:
     - name: Run tests
       run: yarn test:changed misc
       env:
-        FIREBASE_TOKEN: ${{ secrets.FIREBASE_CLI_TOKEN }}
+        FIREBASE_TOKEN: ${{ secrets.FIREBASE_CLI_TOKEN }}

.github/workflows/test-changed.yml

@@ -16,6 +16,9 @@ name: Test Modified Packages
 
 on: pull_request
 
+permissions:
+  contents: read
+
 env:
   # Bump Node memory limit
   NODE_OPTIONS: "--max_old_space_size=4096"
@@ -31,6 +34,7 @@ jobs:
         with:
           # This makes Actions fetch all Git history so run-changed script can diff properly.
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Node (22)
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
         with:
@@ -57,6 +61,7 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Node (22)
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
         with:
@@ -84,6 +89,7 @@ jobs:
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # ratchet:actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Set up Node (22)
         uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # ratchet:actions/setup-node@v4
         with:
@@ -98,4 +104,4 @@ jobs:
       - name: Run tests on changed packages
         run: yarn test:changed core
         env:
-          BROWSERS: 'WebkitHeadless'
+          BROWSERS: 'WebkitHeadless'