fix(gha): configure zizmor as separate workflow, use explicit persist-credentials

Author: cgoetz-inovex

.github/workflows/ci.yaml

@@ -43,20 +43,6 @@ jobs:
       - name: Publish to local maven repo
         run: make install
 
-  zizmor:
-    name: zizmor
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Run zizmor
-        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
-
   cd:
     name: CD
     runs-on: ubuntu-latest
@@ -70,15 +56,15 @@ jobs:
         with:
           # we need to fetch all existing git tags
           fetch-depth: 0
-          persist-credentials: false
+          # Required to push release tags from scripts/publish.sh.
+          persist-credentials: true
 
       - name: Create git tags and publish to Maven Central
         env:
           GPG_SIGNING_KEY: "${{ secrets.GPG_SIGNING_KEY }}"
           GPG_SIGNING_PASSWORD: "${{ secrets.GPG_SIGNING_PASSWORD }}"
           ORG_GRADLE_PROJECT_mavenCentralUsername: "${{ secrets.MAVEN_CENTRAL_USERNAME }}"
           ORG_GRADLE_PROJECT_mavenCentralPassword: "${{ secrets.MAVEN_CENTRAL_PASSWORD }}"
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git config --global user.name "SDK Releaser Bot"
           git config --global user.email "noreply@stackit.de"

.github/workflows/zizmor.yaml

@@ -0,0 +1,24 @@
+name: zizmor
+
+permissions: {}
+
+on:
+  pull_request:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0

scripts/publish.sh

@@ -27,8 +27,7 @@ for file in $(find . -print | sed 's|^./||' | grep -E "(^services/[^/]+/VERSION$
         # Tag doesn't exist. Create a tag and push it.
         echo "Tag '$expected_tag' does not exist."
         git tag -a $expected_tag -m "Release $version"
-        auth_header=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0)
-        git -c http.extraheader="AUTHORIZATION: basic $auth_header" push origin tag "$expected_tag"
+        git push origin tag "$expected_tag"
 
         ./gradlew "${gradle_subproject}:publishToMavenCentral"
     fi