fix(ci): resolve zizmor and actionlint findings in workflows

.github/workflows/docker.yaml

@@ -119,21 +119,28 @@ jobs:
         if: ${{ env.ACT != 'true' }}
         env:
           COSIGN_EXPERIMENTAL: 1
+          TAGS: ${{ steps.meta.outputs.tags }}
+          DIGEST: ${{ steps.image.outputs.digest }}
+          REPO: ${{ github.repository }}
+          WORKFLOW_NAME: ${{ github.workflow }}
+          COMMIT_SHA: ${{ github.sha }}
         run: |
-          IFS=',' read -ra TAGS <<< "${{ steps.meta.outputs.tags }}"
-          for tag in "${TAGS[@]}"; do
+          IFS=',' read -ra TAG_LIST <<< "$TAGS"
+          for tag in "${TAG_LIST[@]}"; do
             cosign sign \
-              -a "repo=${{ github.repository }}" \
-              -a "workflow=${{ github.workflow }}" \
-              -a "sha=${{ github.sha }}" \
+              -a "repo=$REPO" \
+              -a "workflow=$WORKFLOW_NAME" \
+              -a "sha=$COMMIT_SHA" \
               --yes \
-              "$tag"@${{ steps.image.outputs.digest }}
+              "$tag@$DIGEST"
           done
       - name: Extract first tag
         id: first-tag
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
         run: |
-          IFS=$'\n' read -ra TAGS <<< "${{ steps.meta.outputs.tags }}"
-          echo "tag=${TAGS[0]}" >> $GITHUB_OUTPUT
+          IFS=$'\n' read -ra TAG_LIST <<< "$TAGS"
+          echo "tag=${TAG_LIST[0]}" >> "$GITHUB_OUTPUT"
       - name: Generate SBOM
         if: ${{ env.ACT != 'true' }}
         uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0

.github/workflows/docs-release.yaml

@@ -26,5 +26,7 @@ jobs:
           git config --global user.name "Docs Deploy"
           git config --global user.email "docs.deploy@opendefense.cloud"
       - name: Build Docs Website
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
-          mike deploy --push --update-aliases ${{ github.event.release.tag_name }} latest
+          mike deploy --push --update-aliases "$RELEASE_TAG" latest

.github/workflows/helm-publish.yaml

@@ -65,25 +65,27 @@ jobs:
 
       - name: Extract version from tag
         id: version
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
+          if [[ "$GITHUB_REF" == refs/tags/* ]]; then
             # Remove 'v' prefix from tag if present (e.g., v0.1.0 -> 0.1.0)
             VERSION=${GITHUB_REF_NAME#v}
-            echo "source=tag" >> $GITHUB_OUTPUT
+            echo "source=tag" >> "$GITHUB_OUTPUT"
           else
             # For pull requests and other refs, compute a semver version
             # Format: 0.0.0-pr.<pr_number>.<short_sha>
-            PR_NUMBER=${{ github.event.pull_request.number }}
-            SHORT_SHA=$(echo ${{ github.sha }} | cut -c1-7)
+            SHORT_SHA=${GITHUB_SHA:0:7}
             VERSION="0.0.0-pr.${PR_NUMBER}.${SHORT_SHA}"
-            echo "source=computed" >> $GITHUB_OUTPUT
+            echo "source=computed" >> "$GITHUB_OUTPUT"
           fi
-          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "Chart version: ${VERSION}"
 
       - name: Update chart version and appVersion
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          VERSION=${{ steps.version.outputs.version }}
           for chart in charts/*/; do
             if [ -f "${chart}Chart.yaml" ]; then
               CHART_NAME=$(basename "${chart}")
@@ -100,6 +102,8 @@ jobs:
           done
 
       - name: Package and publish Helm charts
+        env:
+          REPO_OWNER: ${{ github.repository_owner }}
         run: |
           for chart in charts/*/; do
             if [ -f "${chart}Chart.yaml" ]; then
@@ -110,12 +114,12 @@ jobs:
               helm package "${chart}"
 
               # Push to OCI registry
-              PACKAGE=$(ls ${CHART_NAME}-*.tgz)
-              helm push "${PACKAGE}" oci://ghcr.io/${{ github.repository_owner }}/charts &> push-metadata.txt
-              echo "✓ Published ${PACKAGE} to ghcr.io/${{ github.repository_owner }}/charts"
+              PACKAGE=$(ls "${CHART_NAME}"-*.tgz)
+              helm push "${PACKAGE}" "oci://ghcr.io/${REPO_OWNER}/charts" &> push-metadata.txt
+              echo "✓ Published ${PACKAGE} to ghcr.io/${REPO_OWNER}/charts"
               CHART_DIGEST=$(awk '/Digest: /{print $2}' push-metadata.txt)
-              echo "CHART_DIGEST=${CHART_DIGEST}" | tee -a $GITHUB_ENV
+              echo "CHART_DIGEST=${CHART_DIGEST}" | tee -a "$GITHUB_ENV"
 
-              cosign sign --yes "ghcr.io/${{ github.repository_owner }}/charts/${CHART_NAME}@${CHART_DIGEST}"
+              cosign sign --yes "ghcr.io/${REPO_OWNER}/charts/${CHART_NAME}@${CHART_DIGEST}"
             fi
           done

.github/workflows/osv-scanner.yml

@@ -11,15 +11,18 @@ on:
     branches: ["main"]
 
 permissions:
-  # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
-  actions: read
-  # Require writing security events to upload SARIF file to security tab
-  security-events: write
   # Read commit contents
   contents: read
 
 jobs:
   scan-scheduled:
+    permissions:
+      # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
+      actions: read
+      # Require writing security events to upload SARIF file to security tab
+      security-events: write
+      # Read commit contents
+      contents: read
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
     uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1
     with:
@@ -29,6 +32,13 @@ jobs:
         -r
         ./
   scan-pr:
+    permissions:
+      # Required to upload SARIF file to CodeQL. See: https://github.com/github/codeql-action/issues/2117
+      actions: read
+      # Require writing security events to upload SARIF file to security tab
+      security-events: write
+      # Read commit contents
+      contents: read
     if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
     uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1
     with:

.github/workflows/release.yaml

@@ -29,7 +29,7 @@ jobs:
             echo "::error::Expected exactly one goVersion assignment in flake.nix"
             exit 1
           fi
-          echo "version=$GO_VERSION" >> $GITHUB_OUTPUT
+          echo "version=$GO_VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7

.github/workflows/test-e2e.yaml

@@ -57,4 +57,4 @@ jobs:
           IMAGE_TAG: ${{ inputs.image-tag }}
           GHCR_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          make test-e2e E2E_IMAGE_SOURCE=$E2E_IMAGE_SOURCE TAG=$IMAGE_TAG REGISTRY=$REGISTRY
+          make test-e2e E2E_IMAGE_SOURCE="$E2E_IMAGE_SOURCE" TAG="$IMAGE_TAG" REGISTRY="$REGISTRY"