ci: resolve zizmor security findings in github actions workflows

Author: akushnarov

.github/workflows/ci.yaml

@@ -56,7 +56,9 @@ concurrency:
   cancel-in-progress: true
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
-permissions: read-all
+# Declare default permissions as read only.
+permissions:
+  contents: read
 
 jobs:
   python-checks:
@@ -68,6 +70,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python and restore cache
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -112,6 +115,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python and restore cache
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -144,6 +149,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python and restore cache
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -173,6 +180,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
         # Note: deliberately not using our Python cache here b/c this runs
         # a different version of Python.
@@ -202,6 +211,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python and restore cache
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -228,6 +238,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install yamllint
         run: |
@@ -248,6 +260,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run hadolint on Dockerfiles
         env:
@@ -258,7 +272,7 @@ jobs:
           files=(**/[Dd]ockerfile*)
           if [[ ${#files[@]} -gt 0 ]]; then
             docker run --rm -v "${PWD}:/app" -w /app \
-            ghcr.io/hadolint/hadolint@${{env.sha}} /bin/hadolint "${files[@]}"
+            "ghcr.io/hadolint/hadolint@${sha}" /bin/hadolint "${files[@]}"
           fi
 
   workflow-lint:
@@ -268,6 +282,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run actionlint
         uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
@@ -283,6 +299,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Run shellcheck on shell scripts
         run: |
@@ -296,6 +314,8 @@ jobs:
     steps:
       - name: Check out a copy of the git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python and restore cache
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0

.github/workflows/nightly-pytest.yaml

@@ -35,8 +35,13 @@ on:
   # Allow manual invocation.
   workflow_dispatch:
 
+concurrency:
+  cancel-in-progress: true
+  group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
+
 # Declare default workflow permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   Pytest:
@@ -75,6 +80,8 @@ jobs:
     steps:
       - name: Check out a copy of the OpenFermion git repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{matrix.python-version}}
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
@@ -89,7 +96,11 @@ jobs:
         run: pip install -r dev_tools/requirements/envs/pytest.env.txt
 
       - name: Install cirq-core (current stable version)
-        run: pip install -U cirq-core ${{inputs.args}}
+        env:
+          INSTALL_ARGS: ${{inputs.args}}
+        run: |
+          # shellcheck disable=SC2086
+          pip install -U cirq-core $INSTALL_ARGS
 
       - name: Set up Pytest output problem matcher
         run: echo '::add-matcher::.github/problem-matchers/pytest.json'

.github/workflows/nightly.yaml

@@ -29,19 +29,20 @@ on:
   workflow_dispatch:
 
 # Declare default permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   cirq-stable:
     name: Nightly Pytest Cirq stable
-    uses: ./.github/workflows/nightly-pytest.yaml
+    uses: $/.github/workflows/nightly-pytest.yaml
     with:
       args: ''
       reason: '(nightly)'
 
   cirq-pre:
     name: Nightly Pytest Cirq pre-release
-    uses: ./.github/workflows/nightly-pytest.yaml
+    uses: $/.github/workflows/nightly-pytest.yaml
     with:
       args: '--pre'
       reason: '(nightly)'

.github/workflows/scorecard-scanner.yaml

@@ -39,20 +39,21 @@ concurrency:
   group: ${{github.workflow}}-${{github.event.pull_request.number||github.ref}}
 
 # Declare default workflow permissions as read only.
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   run-scorecard:
     # Skip fork PRs to avoid "Analysis configuration not found" errors.
     if: >-
       github.repository_owner == 'quantumlib' &&
       (github.event_name != 'pull_request' ||
-       github.event.pull_request.head.repo.fork == false)
+       github.event.pull_request.head.repo.full_name == github.repository)
     name: Scorecard analyzer
     runs-on: ubuntu-24.04
     permissions:
-      security-events: write
-      id-token: write
+      security-events: write # Needed to upload SARIF results to GitHub Code Scanning dashboard.
+      id-token: write # Needed to sign and publish Scorecard results.
     timeout-minutes: 15
     steps:
       - name: Check out a copy of the git repository
@@ -83,10 +84,11 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Write the Scorecard report page link to the workflow summary
+        env:
+          REPO: ${{github.repository}}
         run: |
-          repo="${{github.repository}}"
-          url="https://scorecard.dev/viewer/?uri=github.com/${repo}"
+          url="https://scorecard.dev/viewer/?uri=github.com/${REPO}"
           {
           echo -n "The results are available on the OpenSSF Scorecard "
-          echo "[report page for ${{github.repository}}]($url)."
+          echo "[report page for ${REPO}]($url)."
           } >> "$GITHUB_STEP_SUMMARY"