[migmartri]

Fixes all high-severity and artipacked findings (22 of 47) from a zizmor v1.26.1 audit of the GitHub Actions workflows.

High severity (8 findings)

Template injection (6) — release.yaml
The release workflow interpolates github.ref_name directly into run: blocks across 5 steps (SBOM upload, source code download, version bump scripts, release notes update). Tag names are not shell-sanitized and the release job holds contents: write / packages: write / id-token: write. Routed all occurrences through RELEASE_TAG env vars instead of inline ${{ }} expansion.

GitHub App token (1) — scm_configuration_check.yaml
actions/create-github-app-token was called without scoping permissions, so the minted token inherited the app's full installation permissions. Upgraded to v3.2.0 and added permission-contents: read / permission-metadata: read inputs.

Cache poisoning (1) — release.yaml
actions/setup-go had caching enabled by default in the publishing job. Set cache: false to eliminate the cache-poisoning vector for release builds.

Artipacked (14 findings)

Added persist-credentials: false to every actions/checkout step across 10 workflow files that does not require git push. The release job's checkout is also set to false since peter-evans/create-pull-request handles its own authentication via its token input.

Assisted-by: Claude Code

[cubic-dev-ai]

No issues found across 10 files

_{Re-trigger cubic}