From a7067313a1f59fc1d835a43b8d4389a7dc242112 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:17 -0700
Subject: [PATCH] ci: remediate zizmor findings

---
 .github/workflows/build.yml                           | 4 ++++
 .github/workflows/codeql.yml                          | 2 ++
 .github/workflows/fossa.yml                           | 2 ++
 .github/workflows/gradle-wrapper-validation.yml       | 2 ++
 .github/workflows/issue-management-feedback-label.yml | 2 ++
 .github/workflows/oats-tests.yml                      | 2 ++
 .github/workflows/prometheus-test.yml                 | 2 ++
 .github/workflows/reusable-lint-check.yml             | 1 +
 8 files changed, 17 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5ea9a577e6..71185b8397 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,6 +25,8 @@ jobs:
           - windows-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK for running Gradle
         uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
@@ -48,6 +50,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK for running Gradle
         uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b0a59debd4..16af495deb 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,6 +29,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Java 17
         if: matrix.language == 'java'
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index 300f973c1c..a16a63d954 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
         with:
diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
index 62522858c5..6c2dfc7994 100644
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ b/.github/workflows/gradle-wrapper-validation.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       # this needs to be in its own workflow in order to make OSSF scorecard happy
       - uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
diff --git a/.github/workflows/issue-management-feedback-label.yml b/.github/workflows/issue-management-feedback-label.yml
index 56664b31c2..a9b5b4d845 100644
--- a/.github/workflows/issue-management-feedback-label.yml
+++ b/.github/workflows/issue-management-feedback-label.yml
@@ -19,6 +19,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Remove labels
         env:
diff --git a/.github/workflows/oats-tests.yml b/.github/workflows/oats-tests.yml
index 537ea21d15..6464d550a2 100644
--- a/.github/workflows/oats-tests.yml
+++ b/.github/workflows/oats-tests.yml
@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Check out
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK for running Gradle
         uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
diff --git a/.github/workflows/prometheus-test.yml b/.github/workflows/prometheus-test.yml
index 46367cdde1..8fa969e280 100644
--- a/.github/workflows/prometheus-test.yml
+++ b/.github/workflows/prometheus-test.yml
@@ -19,6 +19,8 @@ jobs:
     steps:
       - name: Check out
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up JDK for running Gradle
         uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
diff --git a/.github/workflows/reusable-lint-check.yml b/.github/workflows/reusable-lint-check.yml
index 9f3a4bbe40..402d344555 100644
--- a/.github/workflows/reusable-lint-check.yml
+++ b/.github/workflows/reusable-lint-check.yml
@@ -13,6 +13,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0 # needed for merge-base used in modified-files mode
+          persist-credentials: false
 
       - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0