ci: add zizmor workflow audit

.github/dependabot.yml

@@ -23,6 +23,8 @@ updates:
       day: wednesday
       time: '22:00'
       timezone: Etc/UTC
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 5
     groups:
       minor-and-patch:

.github/workflows/android-instrumented-data-tests.yml

@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
         uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad #v6.1.0

.github/workflows/android-unit-tests.yml

@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
         uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad #v6.1.0

.github/workflows/build-apk.yml

@@ -61,17 +61,20 @@ jobs:
       # Validate build variant (mainly for workflow_call usage)
       - name: Validate build variant
         run: |
-          case "${{ inputs.build_variant }}" in
+          case "${INPUTS_BUILD_VARIANT}" in
             originalDebug|originalRelease|mdmDebug|mdmRelease|qaDebug|qaRelease) ;;
-            *) echo "Invalid build_variant: ${{ inputs.build_variant }}" && exit 1 ;;
+            *) echo "Invalid build_variant: ${INPUTS_BUILD_VARIANT}" && exit 1 ;;
           esac
+        env:
+          INPUTS_BUILD_VARIANT: ${{ inputs.build_variant }}
 
       # Checkout the repo
       - name: Checkout current repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
         with:
           repository: owncloud/android
           ref: ${{ inputs.version }}
+          persist-credentials: false
 
       # Retrieve and expose the app commit hash as a workflow output
       - name: Get commit hash
@@ -101,20 +104,22 @@ jobs:
 
       # Build the apk with the given variant
       - name: Build APK
-        run: ./gradlew clean assemble${{ inputs.build_variant }}
+        run: ./gradlew clean assemble${INPUTS_BUILD_VARIANT}
+        env:
+          INPUTS_BUILD_VARIANT: ${{ inputs.build_variant }}
 
       # Name the output artifact with date, commit, and variant
       - name: Set artifact name
         id: set_artifact
         run: |
           DATE=$(date +%Y%m%d_%H%M)
           COMMIT=$(git rev-parse --short HEAD)
-          VARIANT="${{ inputs.build_variant }}"
+          VARIANT="${INPUTS_BUILD_VARIANT}"
 
           # Extract flavor and build type from variant (e.g. qaRelease -> qa / release)
           FLAVOR=$(echo "$VARIANT" | sed -E 's/(Release|Debug)//' | tr '[:upper:]' '[:lower:]')
           BUILD_TYPE=$(echo "$VARIANT" | grep -qi debug && echo debug || echo release)
-          NAME="ownCloud-${{ inputs.build_variant }}-${COMMIT}-${DATE}.apk"
+          NAME="ownCloud-${INPUTS_BUILD_VARIANT}-${COMMIT}-${DATE}.apk"
 
           APK_PATH=$(find ./owncloudApp/build/outputs/apk/$FLAVOR/$BUILD_TYPE/ -name "*.apk")
 
@@ -131,6 +136,8 @@ jobs:
 
           # Publish as output
           echo "artifact_name=$NAME" >> $GITHUB_OUTPUT
+        env:
+          INPUTS_BUILD_VARIANT: ${{ inputs.build_variant }}
 
       # Publish the artifact
       - name: Upload artifact

.github/workflows/detekt.yml

@@ -23,6 +23,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+      with:
+        persist-credentials: false
     - name: Set up JDK 17
       uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad #v6.1.0
       with:

.github/workflows/gradle-wrapper-validation.yml

@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+        with:
+          persist-credentials: false
       - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 #v6.4.0
         with:
           validate-wrappers: true

.github/workflows/sbom.yml

@@ -15,8 +15,9 @@ concurrency:
   group: sbom-update
   cancel-in-progress: false
 
+# Everything that writes (the SBOM branch and PR) uses the App token below.
 permissions:
-  contents: write
+  contents: read
 
 jobs:
   sbom:
@@ -120,6 +121,8 @@ jobs:
         with:
           app-id: ${{ secrets.SBOM_APP_ID }}
           private-key: ${{ secrets.SBOM_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       # Create a branch with latest SBOM changes only if there are changes
       - name: Create or update SBOM PR

.github/workflows/validate-source-strings.yml

@@ -14,6 +14,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install xmlstarlet
         run: sudo apt-get update && sudo apt-get install -y xmlstarlet

.github/workflows/zizmor.yml

@@ -0,0 +1,30 @@
+name: Zizmor
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+  schedule:
+    # Weekly: online audits (known-vulnerable actions, impostor commits) can
+    # start failing without a code change.
+    - cron: '0 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# Grouped per event, so a push to the default branch can never cancel or
+# displace the weekly run; only pull request runs cancel superseded ones.
+concurrency:
+  group: zizmor-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  zizmor:
+    name: Zizmor
+    uses: owncloud/reusable-workflows/.github/workflows/zizmor.yml@main