googleapis · aandreassa · Jun 30, 2026 · Jun 30, 2026
@@ -1,4 +1,7 @@
 name: Bump-Version
+
+permissions:
+  contents: read
 on:
   workflow_dispatch:
     inputs:
@@ -20,9 +23,11 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.YOSHI_CODE_BOT_TOKEN }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
       - name: Install Ruby 3.3
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
         with:
           ruby-version: "3.3"
       - name: Install tools

@@ -1,4 +1,7 @@
 name: CI
+
+permissions:
+  contents: read
 on:
   pull_request:
     branches:
@@ -52,18 +55,22 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout repo
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
     - name: Install Ruby ${{ matrix.ruby }}
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
       with:
         ruby-version: "${{ matrix.ruby }}"
     - name: Install NodeJS 18.x
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       with:
         node-version: "18.x || 24.x"
     - name: Install tools
+      # zizmor: ignore[template-injection]
       run: "gem install --no-document toys && npm install linkinator"
     - name: Test ${{ matrix.task }}
+      # zizmor: ignore[template-injection]
       run: |
         toys ci -v ${{ matrix.task }} --github-event-name=${{ github.event_name }} --github-event-payload=${{ github.event_path }} ${{ github.event.inputs.flags }}
     - name: Open Issues

@@ -41,11 +41,13 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -72,6 +74,6 @@ jobs:
     #     ./location_of_script_within_repo/buildscript.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4
       with:
         category: "/language:${{matrix.language}}"
@@ -2,6 +2,9 @@
 # client library.
 # See https://github.com/googleapis/cloud-bigtable-clients-test
 on:
+
+permissions:
+  contents: read
   push:
     branches:
     - main

@@ -1,5 +1,8 @@
 name: Delete a library
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
     inputs:
@@ -18,9 +21,11 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.YOSHI_CODE_BOT_TOKEN }}
     steps:
     - name: Checkout repo
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
     - name: Install Ruby 3.4
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
       with:
         ruby-version: "3.4"
     - name: Install tools

@@ -1,5 +1,8 @@
 name: Create New Library
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
     inputs:
@@ -15,10 +18,11 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.YOSHI_CODE_BOT_TOKEN }}
     steps:
     - name: Checkout repo
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
       with:
           # IMPORTANT: This ensures the checkout uses the correct identity for git operations
           token: ${{ secrets.YOSHI_CODE_BOT_TOKEN }}
+          persist-credentials: false
     # - name: Debug Token Permissions
     #   # Uncomment to debug access token issues
     #   env:
@@ -33,11 +37,11 @@ jobs:
     #     echo "=== 3. Can I see the target fork? ==="
     #     gh repo view yoshi-code-bot/google-cloud-ruby --json viewerPermission
     - name: Install Ruby 3.3
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
       with:
         ruby-version: "3.3"
     - name: Install Bazel
-      uses: bazel-contrib/setup-bazel@0.18.0
+      uses: bazel-contrib/setup-bazel@083175551ceeceebc757ebee2127fde78840ca77 # 0.18.0
     - name: Install tools
       run: |
         gem install --no-document toys

@@ -1,5 +1,8 @@
 name: OwlBot Manual Run
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
     inputs:
@@ -18,13 +21,15 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.YOSHI_CODE_BOT_TOKEN }}
     steps:
     - name: Checkout repo
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
     - name: Install Ruby 3.3
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
       with:
         ruby-version: "3.3"
     - name: Install Bazel
-      uses: bazel-contrib/setup-bazel@0.18.0
+      uses: bazel-contrib/setup-bazel@083175551ceeceebc757ebee2127fde78840ca77 # 0.18.0
     - name: Install tools
       run: |
         gem install --no-document toys

@@ -21,9 +21,11 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
       - name: Install Ruby 3.3
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
         with:
           ruby-version: "3.3"
       - name: Install tools

@@ -1,4 +1,7 @@
 on:
+
+permissions:
+  contents: read
   push:
     branches:
       - main

@@ -1,5 +1,8 @@
 name: Tombstone a Library
 
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
     inputs:
@@ -18,9 +21,11 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.YOSHI_CODE_BOT_TOKEN }}
     steps:
     - name: Checkout repo
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
     - name: Install Ruby 3.4
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
       with:
         ruby-version: "3.4"
     - name: Install tools

@@ -22,9 +22,11 @@ jobs:
       pull-requests: read
     steps:
     - name: Checkout repo
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      with:
+        persist-credentials: false
     - name: Install Ruby 3.3
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@9eb537ca036ebaed86729dcb9309076e4c5c3b74 # v1
       with:
         ruby-version: "3.3"
     - name: Install tools