ci: remediate zizmor findings

[opentelemetrybot]

Tracked in open-telemetry/sig-security#293.

Resolves existing findings from the OpenTelemetry shared workflow.

The workflow:

• runs the regular persona on pull requests, pushes to main, release/*, and a randomized weekly schedule;
• uploads results to GitHub code scanning;
• uses the shared workflow pinned to an immutable commit.

Zizmor remediation

This change also resolves findings from these zizmor rules:

• artipacked
• excessive-permissions
• ref-version-mismatch
• template-injection

After merge

1. Confirm the Zizmor workflow succeeds on the merged default-branch commit and its code-scanning analysis has no findings.
2. Confirm open-telemetry/admin continues to require zizmor code scanning for this repository.
3. On the next repository pull request, confirm GitHub reports a required zizmor code-scanning result.

If enforcement unexpectedly blocks a valid change, restore require_zizmor = false in open-telemetry/admin while leaving scanning enabled.

[opentelemetry-pr-dashboard]

Pull request dashboard status

Status last refreshed: 2026-07-21 04:38:47 UTC.

• Waiting on: Author
• Next step: Move out of draft to request review.

This automated status or its linked feedback items may be incorrect. If something looks wrong, report it with the result you expected.

[Copilot]

Pull request overview

Hardens GitHub Actions workflows to remediate zizmor security findings.

Changes:

• Disables persisted checkout credentials across workflows.
• Reduces permissions and moves expressions into environment variables.
• Updates generated gh-aw lockfiles and explicit Git authentication.

Reviewed changes

Copilot reviewed 44 out of 44 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
.github/aw/actions-lock.json	Adds the versioned app-token action lock.
.github/workflows/auto-license-report.yml	Secures checkout and push authentication.
.github/workflows/auto-update-otel-sdk.yml	Secures automated SDK update pushes.
.github/workflows/backport.yml	Disables persisted checkout credentials.
.github/workflows/build-common.yml	Hardens build checkouts and expressions.
.github/workflows/build-daily.yml	Hardens daily-build checkout.
.github/workflows/codeql.yml	Hardens CodeQL checkout.
.github/workflows/copilot-setup-steps.yml	Hardens Copilot setup checkout.
.github/workflows/dependency-review.yml	Hardens dependency-review checkout.
.github/workflows/documentation-synchronization-audit.yml	Hardens documentation audit checkout.
.github/workflows/draft-release-notes.yml	Adds explicit authenticated Git setup.
.github/workflows/flaky-test-remediation.yml	Hardens checkouts and expression handling.
.github/workflows/fossa.yml	Hardens FOSSA checkout.
.github/workflows/gradle-wrapper-validation.yml	Hardens wrapper-validation checkout.
.github/workflows/issue-management-feedback-label.yml	Hardens label-workflow checkout.
.github/workflows/metadata-update.yml	Moves branch outputs into environment variables.
.github/workflows/metadata-validation.yml	Hardens metadata-validation checkout.
.github/workflows/module-cleanup.lock.yml	Regenerates the module-cleanup workflow.
.github/workflows/module-cleanup.md	Corrects schedule and action version metadata.
.github/workflows/overhead-benchmark-daily.yml	Hardens benchmark checkouts.
.github/workflows/pr-review.lock.yml	Regenerates the review workflow.
.github/workflows/pr-review.md	Narrows permissions and secures expressions.
.github/workflows/pr-smoke-test-early-jdk8-images.yml	Hardens smoke-test checkout.
.github/workflows/pr-smoke-test-fake-backend-images.yml	Hardens Linux and Windows checkouts.
.github/workflows/prepare-patch-release.yml	Hardens patch-release checkout.
.github/workflows/prepare-release-branch.yml	Adds explicit Git authentication.
.github/workflows/publish-petclinic-benchmark-image.yml	Hardens benchmark-image checkout.
.github/workflows/publish-smoke-test-early-jdk8-images.yml	Secures tag expression and checkout.
.github/workflows/publish-smoke-test-fake-backend-images.yml	Secures tag expressions and checkouts.
.github/workflows/publish-smoke-test-servlet-images.yml	Secures output handling and checkout.
.github/workflows/release-update-cloudfoundry-index.yml	Hardens CloudFoundry checkouts.
.github/workflows/release.yml	Hardens release-job checkouts.
.github/workflows/rerun-failed-daily-jobs.yml	Hardens rerun-workflow checkout.
.github/workflows/rerun-flaky-pr-jobs.yml	Hardens flaky-job rerun checkout.
.github/workflows/reusable-build-servlet-images.yml	Hardens reusable image-build checkout.
.github/workflows/reusable-lint-check.yml	Hardens lint checkout.
.github/workflows/reusable-muzzle.yml	Hardens muzzle checkout.
.github/workflows/reusable-native-tests.yml	Hardens checkout and corrects action version.
.github/workflows/reusable-pr-smoke-test-images.yml	Hardens reusable PR image checkout.
.github/workflows/reusable-publish-smoke-test-images.yml	Hardens reusable publishing checkout.
.github/workflows/reusable-test-latest-deps.yml	Hardens checkout and test-task expression.
.github/workflows/reusable-workflow-notification.yml	Hardens notification checkout.
.github/workflows/sonatype-guide-dependency-audit-daily.yml	Hardens audit checkout.
.github/workflows/update-latest-dep-versions.yml	Hardens dependency-update checkout.

[Copilot]

Pull request overview

Copilot reviewed 44 out of 44 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 44 out of 44 changed files in this pull request and generated no new comments.

[trask]

cc @trask to review first