ci: run zizmor on GitHub Actions and fix security findings

[mayankdev-oss]

Fixes #4844

Changes

This PR integrates the zizmor static analyzer as a CI check to harden our GitHub Actions workflows and resolves the immediate security vulnerabilities flagged by the tool.

Specifically, it:

• Sets up the .github/workflows/zizmor.yaml CI workflow to continuously scan and upload SARIF results to GitHub Advanced Security.
• Resolves all auto-fixable findings (e.g., injecting persist-credentials: false into actions/checkout steps across multiple workflows).
• Manually patches high-severity template injection risks in publish.yml by moving context variables safely out of the run: execution block and into the step's env: mapping.

Note: As requested in the original issue description, I have intentionally left the secrets-inherit warnings in chatops-retest.yml and slash.yml untouched. I will file a separate follow-up issue to handle those broader architectural changes once this baseline is merged.

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Docs included if any changes are user facing
• Tests included if any functionality added or changed
• Follows the commit message standard
• Meets the Tekton contributor standards (including functionality, content, code)
• Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
• Release notes block below has been updated with any user facing changes (new features, significant UI changes, API changes, bug fixes, changes requiring upgrade notices or deprecation warnings)
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

NONE

[tekton-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign lyndseybu after the PR has been reviewed.
You can assign the PR to them by writing /assign @lyndseybu in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mayankdev-oss]

/kind cleanup

[AlanGreene]

Thanks for the PR @mayankdev-oss.

The description mentions a new zizmor workflow but it looks like this hasn't been included in the change. Feel free to add it to a separate PR if you prefer.

While most of the template injection risks were false positives there's no harm in moving these to environment variables for consistency and to avoid future issues. There's also some opportunity for further cleanup / simplification, I've left a few comments.

Can you also update the commit message to include a description of the change / reason? Something similar to what you've added in the PR description is fine.

Let me know if you have any questions.

[mayankdev-oss]

@AlanGreene Thanks for the feedback! I've updated the workflows to use the shorter variable names and standard GitHub environment variables as requested. I also amended the commit message to include the context. The updates have been force-pushed—let me know if everything looks good to go now!

[mayankdev-oss]

@AlanGreene I updated the environment variables and commit messages last week based on your feedback. Let me know if this looks good to go or if you need anything else before running the workflows.

[AlanGreene]

Thanks for the updates @mayankdev-oss. I'm currently working on fixing an unrelated issue with the nightly build. Once that's resolved and we have a green build again I'll review this PR for any additional changes but from a quick look now it should be ok.

[tekton-robot]

@mayankdev-oss: PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[AlanGreene]

@mayankdev-oss can you please rebase this and squash your commits?

[AlanGreene]

nit: restore the newline at end of file