run zizmor .github/workflows/* --fix=all

.github/workflows/build-and-push-bskyweb-aws.yaml

@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Docker buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0

.github/workflows/build-and-push-bskyweb-ghcr.yaml

@@ -24,6 +24,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Docker buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0

.github/workflows/build-and-push-embedr-aws.yaml

@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Docker buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0

.github/workflows/build-and-push-link-aws.yaml

@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Docker buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0

.github/workflows/build-and-push-ogcard-aws.yaml

@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Docker buildx
         uses: docker/setup-buildx-action@f211e3e9ded2d9377c8cadc4489a4e38014bc4c9 # v1.7.0

.github/workflows/build-submit-android.yml

@@ -31,6 +31,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/build-submit-ios.yml

@@ -31,6 +31,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -96,10 +97,12 @@ jobs:
       - name: 🏗️ EAS Build
         env:
           PROFILE: ${{ inputs.profile || 'testflight' }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION: ${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER: ${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          SENTRY_RELEASE=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          SENTRY_DIST=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER}
           yarn use-build-number-with-bump
           eas build -p ios
           --profile $PROFILE

.github/workflows/bundle-deploy-eas-update.yml

@@ -51,6 +51,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: ⬇️ Fetch commits from base branch
         if: ${{ github.ref != 'refs/heads/main' }}
@@ -128,9 +129,12 @@ jobs:
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          SENTRY_RELEASE=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          SENTRY_DIST=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER}
           yarn export
+        env:
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION: ${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER: ${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
 
       - name: 📦 Package Bundle and 🚀 Deploy
         if: ${{ !steps.fingerprint.outputs.includes-changes }}
@@ -175,6 +179,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -234,12 +239,15 @@ jobs:
       - name: 🏗️ EAS Build
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          SENTRY_RELEASE=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          SENTRY_DIST=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER}
           yarn use-build-number-with-bump
           eas build -p ios
           --profile testflight
           --local --output build.tar.gz --non-interactive
+        env:
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION: ${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER: ${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
 
       - name: 📂 Extract build artifact
         run: |
@@ -323,6 +331,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 5
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -370,12 +379,15 @@ jobs:
       - name: 🏗️ EAS Build
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          SENTRY_RELEASE=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          SENTRY_DIST=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER}
           yarn use-build-number-with-bump
           eas build -p android
           --profile testflight-android
           --local --output build.apk --non-interactive
+        env:
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION: ${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER: ${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
 
       - name: ⏰ Get a timestamp
         id: timestamp

.github/workflows/claude.yml

@@ -29,6 +29,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Run Claude Code
         id: claude

.github/workflows/golang-test-lint.yml

@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: Git Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Go tooling
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
@@ -33,6 +35,8 @@ jobs:
     steps:
       - name: Git Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Set up Go tooling
         uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:

.github/workflows/lint.yml

@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Verify Node version pins match .nvmrc
         run: |
           set -euo pipefail
@@ -64,6 +66,8 @@ jobs:
     steps:
       - name: ⬇️ Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:

.github/workflows/nightly-update-source-languages.yaml

@@ -19,6 +19,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ssh-key: ${{secrets.GH_ACTION_DEPLOY_KEY}}
+          persist-credentials: false
       - name: Install node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:

.github/workflows/pull-request-comment.yml

@@ -116,6 +116,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ steps.pr-info.outputs.head-sha }}
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -173,9 +174,12 @@ jobs:
       - name: 🏗️ Create Bundle
         run: >
           SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
-          SENTRY_RELEASE=${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          SENTRY_RELEASE=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION}
-          SENTRY_DIST=${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
+          SENTRY_DIST=${STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER}
           yarn export
+        env:
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_RELEASE_VERSION: ${{ steps.env.outputs.EXPO_PUBLIC_RELEASE_VERSION }}
+          STEPS_ENV_OUTPUTS_EXPO_PUBLIC_BUNDLE_IDENTIFIER: ${{ steps.env.outputs.EXPO_PUBLIC_BUNDLE_IDENTIFIER }}
 
       - name: 📦 Package Bundle and 🚀 Deploy
         run: yarn use-build-number bash scripts/bundleUpdate.sh

.github/workflows/pull-request-commit.yml

@@ -27,6 +27,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: 🔧 Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -111,6 +112,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 100
+          persist-credentials: false
 
       - name: ⬇️ Fetch commits from base branch
         run: git fetch origin main:main --depth 100

.github/workflows/sync-internal.yaml

@@ -13,6 +13,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Generate GitHub App Token
         id: app-token
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0

.github/workflows/verify-yarn-lock.yml

@@ -15,6 +15,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Fetch base branch
         env: