fix(ci): zizmor findings

[randoneering]

Description

Just cleanup work after implementing zizmor:

• dropped the spoofable actor check in the dependabot auto-merge
• declared and passed only the two secrets the image build actually needs
• turned off the dependency cache in publish workflows.

Related Issue(s)

Fixes #

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update
• Refactoring (no functional changes)
• Performance improvement
• Test addition or update
• Other (please describe): CI Fix

How Has This Been Tested?

• Unit tests
• Integration tests
• Manual testing
• Other (please describe):

Screenshots (if applicable)

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I understand and take responsibility for every change, and I wrote this pull request description in my own words
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

Additional Notes

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Harden GitHub Actions workflows against zizmor findings

🐞 Bug fix ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Resolves zizmor findings across privileged, reusable, and publishing GitHub Actions workflows.
• Restricts image builds to explicitly declared package and Sentry secrets.
• Disables publish-time dependency caches and documents reviewed security exceptions.

Diagram

graph TD
  A["PR events"] -->|"trusted metadata"| B["API automation"]
  C["Image workflows"] -->|"named secrets"| D["Reusable build"] --> E["GHCR and Sentry"]
  F["Publish workflows"] -->|"cache disabled"| G["Node setup"] --> H["Package registries"]

Loading

High-Level Assessment

The PR uses the appropriate targeted remediations. Retaining pull_request_target is necessary for privileged API operations and is safe here because untrusted code is not executed; explicit secret mappings reduce exposure compared with secrets: inherit; and disabling publish-time caches is safer than maintaining a complex trusted-cache scheme. Switching event types or introducing custom cache isolation would add complexity without a clear benefit.

Files changed (11) +48 / -15

Bug fix (3) +11 / -3

auto-merge.ymlRemove the spoofable actor check from Dependabot merging +5/-1

Remove the spoofable actor check from Dependabot merging

• Relies on the pull request author's login as the authoritative Dependabot identity check. Documents why the privileged trigger is safe and why github.actor provides no additional protection.

.github/workflows/auto-merge.yml

publish-mcp.ymlDisable dependency caching for MCP publishing +3/-1

Disable dependency caching for MCP publishing

• Disables setup-node package-manager caching so the privileged publication job cannot restore cache content potentially poisoned by pull requests.

.github/workflows/publish-mcp.yml

publish-planka-import.ymlDisable dependency caching for importer publishing +3/-1

Disable dependency caching for importer publishing

• Disables setup-node package-manager caching to prevent the publication job from consuming potentially poisoned pull request cache entries.

.github/workflows/publish-planka-import.yml

Other (8) +37 / -12

auto-assign.ymlDocument the privileged auto-assignment trigger +3/-1

Document the privileged auto-assignment trigger

• Adds a zizmor suppression explaining that pull_request_target is limited to API-based assignment and never executes untrusted pull request code.

.github/workflows/auto-assign.yml

build-images.ymlDeclare the reusable image workflow secret contract +7/-0

Declare the reusable image workflow secret contract

• Declares the required GHCR package token and optional Sentry source-map token as workflow_call secrets.

.github/workflows/build-images.yml

docker.ymlPass only required secrets to image builds +5/-2

Pass only required secrets to image builds

• Replaces inherited secrets with explicit GH_PACKAGE_TOKEN and SENTRY_AUTH_TOKEN mappings. Documents the temporary self-repository zizmor suppression.

.github/workflows/docker.yml

helm-chart.ymlDocument the local Helm validation workflow reference +2/-1

Document the local Helm validation workflow reference

• Adds a targeted self-repository suppression for the reusable Helm validation workflow until the pinned actionlint version supports the preferred syntax.

.github/workflows/helm-chart.yml

nightly.ymlRestrict nightly image secrets and document local workflow calls +7/-3

Restrict nightly image secrets and document local workflow calls

• Passes only the package and Sentry tokens into the reusable image build. Adds targeted self-repository suppressions to nightly CI and image workflow references.

.github/workflows/nightly.yml

pr-size-labeler.ymlDocument the privileged PR labeling trigger +2/-0

Document the privileged PR labeling trigger

• Explains that the labeler uses pull_request_target only for API labeling and checks out trusted base-branch configuration.

.github/workflows/pr-size-labeler.yml

release.ymlRestrict release secrets and document reusable workflow references +9/-4

Restrict release secrets and document reusable workflow references

• Replaces inherited image-build secrets with explicit package and Sentry token mappings. Adds targeted self-repository suppressions for image, Helm validation, and chart workflow calls.

.github/workflows/release.yml

ui-review.ymlDocument the local UI review workflow reference +2/-1

Document the local UI review workflow reference

• Adds a targeted self-repository suppression for the reusable UI review workflow until the pinned actionlint parser supports the preferred syntax.

.github/workflows/ui-review.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗