ci: run zizmor on GitHub Actions and fix security findings

.github/workflows/ci.yml

@@ -36,6 +36,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: ${{ github.workspace }}/src/github.com/tektoncd/dashboard
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
@@ -69,6 +70,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -119,6 +122,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: ${{ github.workspace }}/src/github.com/tektoncd/dashboard
+          persist-credentials: false
 
       - name: Set up Go
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0

.github/workflows/codeql-analysis.yml

@@ -40,6 +40,8 @@ jobs:
 
     - name: Checkout repository
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/dependency-review.yml

@@ -23,7 +23,10 @@ jobs:
           egress-policy: audit
 
       - name: 'Checkout Repository'
+
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

.github/workflows/e2e-base-image.yml

@@ -37,7 +37,10 @@ jobs:
         with:
           egress-policy: audit
 
+
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Log in to the Container registry
         uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee  # v4.2.0

.github/workflows/nightly-build.yml

@@ -71,22 +71,25 @@ jobs:
           kustomize build tekton | kubectl apply -f -
 
       - name: Start Tekton Build Pipeline
+        env:
+          LATEST_SHA: ${{ steps.version.outputs.latest_sha }}
+          VERSION_TAG: ${{ steps.version.outputs.version_tag }}
         run: |
           set -euo pipefail  # Exit on any error, undefined variables, or pipe failures
 
           echo "Starting Tekton pipeline…"
 
           PIPELINE_RUN=$(tkn pipeline start dashboard-release \
             --serviceaccount=release-right-meow \
-            --param gitRevision="${{ steps.version.outputs.latest_sha }}" \
-            --param versionTag="${{ steps.version.outputs.version_tag }}" \
-            --param releaseBucket="${{ env.BUCKET }}" \
-            --param imageRegistry=${{ env.REGISTRY }} \
-            --param imageRegistryPath="${{ env.IMAGE_REGISTRY_PATH }}" \
-            --param imageRegistryUser="${{ env.IMAGE_REGISTRY_USER }}" \
+            --param gitRevision="${LATEST_SHA}" \
+            --param versionTag="${VERSION_TAG}" \
+            --param releaseBucket="${BUCKET}" \
+            --param imageRegistry="${REGISTRY}" \
+            --param imageRegistryPath="${IMAGE_REGISTRY_PATH}" \
+            --param imageRegistryUser="${IMAGE_REGISTRY_USER}" \
             --param imageRegistryRegions="" \
             --param koExtraArgs="" \
-            --param repoName="${{ env.REPO_NAME }}" \
+            --param repoName="${REPO_NAME}" \
             --param serviceAccountImagesPath=credentials \
             --param releaseAsLatest="true" \
             --workspace name=workarea,volumeClaimTemplateFile=workspace-template.yaml \
@@ -115,4 +118,4 @@ jobs:
 
           echo "::group::Following Tekton Chains controller logs for 3 minutes…"
           timeout 180 kubectl logs deploy/tekton-chains-controller -n tekton-chains -f || echo "Log follow completed after 3 minutes"
-          echo "::endgroup::"
+          echo "::endgroup::"