chore(ci): add gha linter (zizmore) and fix issues

- pin each action to hash
- use persist-credentials: false on checkout actions
- scope GITHUB_TOKEN to create git tags step

STACKITSDK-614

Author: cgoetz-inovex

.github/workflows/ci.yaml

@@ -1,5 +1,7 @@
 name: CI/CD
 
+permissions: {}
+
 on:
   pull_request:
   workflow_dispatch:
@@ -15,10 +17,12 @@ jobs:
         version: [17, 21, 25]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
-      
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Install java
-        uses: actions/setup-java@v6.1.0
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: 'temurin'
           java-version: '${{ matrix.version }}'
@@ -39,27 +43,42 @@ jobs:
       - name: Publish to local maven repo
         run: make install
 
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+
   cd:
     name: CD
     runs-on: ubuntu-latest
     if: ${{ github.ref_name == 'main' }}
     needs: [ci]
     permissions:
       contents: write
-      actions: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # we need to fetch all existing git tags
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Create git tags and publish to Maven Central
         env:
           GPG_SIGNING_KEY: "${{ secrets.GPG_SIGNING_KEY }}"
           GPG_SIGNING_PASSWORD: "${{ secrets.GPG_SIGNING_PASSWORD }}"
           ORG_GRADLE_PROJECT_mavenCentralUsername: "${{ secrets.MAVEN_CENTRAL_USERNAME }}"
           ORG_GRADLE_PROJECT_mavenCentralPassword: "${{ secrets.MAVEN_CENTRAL_PASSWORD }}"
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           git config --global user.name "SDK Releaser Bot"
           git config --global user.email "noreply@stackit.de"

.github/workflows/labeler.yaml

@@ -23,7 +23,7 @@ jobs:
         run: |
           curl -sSL -o remote-labeler.yml https://raw.githubusercontent.com/stackitcloud/stackit-sdk-go/main/.github/labeler.yml 
       - name: Labeler action
-        uses: actions/labeler@v7.0.0
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
           configuration-path: "remote-labeler.yml"
           sync-labels: false

scripts/publish.sh

@@ -27,7 +27,8 @@ for file in $(find . -print | sed 's|^./||' | grep -E "(^services/[^/]+/VERSION$
         # Tag doesn't exist. Create a tag and push it.
         echo "Tag '$expected_tag' does not exist."
         git tag -a $expected_tag -m "Release $version"
-        git push origin tag $expected_tag
+        auth_header=$(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 -w0)
+        git -c http.extraheader="AUTHORIZATION: basic $auth_header" push origin tag "$expected_tag"
 
         ./gradlew "${gradle_subproject}:publishToMavenCentral"
     fi