[oc-tmueller]

Adds a zizmor audit of this repository's GitHub Actions workflows and Dependabot config, through the reusable owncloud/reusable-workflows/.github/workflows/zizmor.yml (owncloud/reusable-workflows#104). It's part of an org-wide rollout. Once the repo PRs have landed, Zizmor / Zizmor becomes a required check through owncloud/admin.

• Behaviour: any finding, at any severity, fails the check, with an annotation on the offending line. It runs on every PR, on pushes to main and weekly, because online audits such as known-vulnerable actions can start failing without a code change.
• Permissions: contents: read only, so it also works on fork PRs.
• Config: owncloud/* references may stay on @main. Everything else must be SHA-pinned.

Existing findings fixed (separate commits)

• template-injection: inputs were expanded straight into run: scripts, so a crafted value became shell code. These are now passed through env: and quoted where used as paths:
  • workflow_dispatch from_version / to_version
  • the reusable-workflow inputs (ssh host/user/key, oCIS URL, APK version and artifact name)
  • job outputs
• secrets-inherit: sign_latest / sign_master passed every repository secret to sign-apk.yml. They now pass only the three it declares (TEST_KS_B64, TEST_KS_ALIAS, TEST_KS_KEY).
• self-repository: the local reusable workflows and the ansible-setup action are called as $/... instead of ./.... This is GitHub's self-repository syntax, which files written to the workspace at runtime cannot redirect.
• artipacked: checkouts do not persist credentials. No job pushes or fetches with the token.
• dependabot-cooldown: gradle updates wait 7 days, as github-actions already does.
• Not exercised by this PR's CI: update.yml, ocisbackend.yml, sign-apk.yml and cleanup.yml only run on schedule or dispatch. A manual Update Test dispatch after merge is the real check.
• Noticed, not changed: ocisbackend.yml writes the ocis_url dispatch input into $GITHUB_ENV unvalidated. Only users with write access can dispatch it.

zizmor 1.31.1 reports no findings on this branch.

🤖 Generated with Claude Code