From 0f22186be1670b09c091afbf1d7ef4fbfe5489f1 Mon Sep 17 00:00:00 2001
From: Chris Povirk <cpovirk@google.com>
Date: Mon, 3 Aug 2026 12:59:33 -0400
Subject: [PATCH] Address https://docs.zizmor.sh/audits/#artipacked findings.

Google has been rolling out `zizmor` to more of its repos, and `zizmor` wants `persist-credentials: false`.

(Gemini leads me to believe that the risk without `persist-credentials: false` has been minimal since [version 6](https://github.com/actions/checkout/releases/tag/v6.0.0) (https://github.com/actions/checkout/pull/2286?). I haven't tried to verify that. It [doesn't seem like the default `persist-credentials` value is likely to change](https://github.com/actions/checkout/issues/485).)

`zizmor` also wants us to pin `google/oss-fuzz`. I posted https://github.com/google/oss-fuzz/issues/6836#issuecomment-5169599063.
---
 .github/workflows/build.yml                       | 8 ++++++++
 .github/workflows/check-android-compatibility.yml | 2 ++
 .github/workflows/check-api-compatibility.yml     | 3 +++
 .github/workflows/codeql-analysis.yml             | 2 ++
 4 files changed, 15 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index dbf2f80b7b..9ce6bad20b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -39,6 +39,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: "Set up JDK ${{ matrix.java }}"
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
         with:
@@ -55,6 +57,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up JDK
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
         with:
@@ -78,6 +82,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: "Set up GraalVM"
         uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd  # v1.6.3
         with:
@@ -97,6 +103,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
       - name: Set up JDK
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
         with:
diff --git a/.github/workflows/check-android-compatibility.yml b/.github/workflows/check-android-compatibility.yml
index e9c12f249b..a3f02ab6a6 100644
--- a/.github/workflows/check-android-compatibility.yml
+++ b/.github/workflows/check-android-compatibility.yml
@@ -25,6 +25,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up JDK
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
diff --git a/.github/workflows/check-api-compatibility.yml b/.github/workflows/check-api-compatibility.yml
index 149fed1b6c..6c10ddec71 100644
--- a/.github/workflows/check-api-compatibility.yml
+++ b/.github/workflows/check-api-compatibility.yml
@@ -29,6 +29,7 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.base.sha }}
           path: 'gson-old-japicmp'
+          persist-credentials: false
 
       - name: Set up JDK
         uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95  # v5.6.0
@@ -47,6 +48,8 @@ jobs:
 
       - name: Check out new version
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Check API compatibility
         id: check-compatibility
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 1ab89502bb..90e1143f6a 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -38,6 +38,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Set up JDK
       if: ${{ matrix.language == 'java' }}