ci: Resolve Zizmor static security audit findings in workflows and composite actions - #249

Merged

vkarampudi merged 12 commits into

google:masterfrom

vkarampudi:fix-zizmor-security

Aug 14, 2026

Commits on Aug 13, 2026

ci: resolve Zizmor static security audit findings in workflows and actions
vkarampudi
committed
b9f2f91
ci: fix Bazel/Bazelisk installation for macOS ARM64 runners
vkarampudi
committed
59127dc
ci: upgrade pypa/gh-action-pypi-publish to release/v1.12 to fix GHSA-vxmw-7h4f-hqxh
vkarampudi
committed
2d5000d
ci: remove conda clang from macOS environment to use native Xcode toolchain
vkarampudi
committed
a9bda59
ci: update pypa/gh-action-pypi-publish to latest release v1.14.2
vkarampudi
committed
0e338fd
build: unset conda APPLE_SDK_VERSION_OVERRIDE/XCODE_VERSION_OVERRIDE on macOS to fix Bazel target SDK
vkarampudi
committed
273b4f2
build: configure BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 on macOS to bypass wrapped_clang
vkarampudi
committed
e3cc1a4
ci: separate doc check into ci-docs.yml (read-only) and deploy into cd-docs.yml (push-only)
vkarampudi
committed
3de6ce8
ci: suppress excessive-permissions check with justification for docs deploy
vkarampudi
committed
72589cb
ci: consolidate documentation check and deployment into cd-docs.yml
vkarampudi
committed
aad83a2
ci: eliminate PR write permissions by making ci-docs.yml strictly read-only and cd-docs.yml push-only
vkarampudi
committed
91c019e
ci: set top-level permissions to contents: read in cd-docs.yml
vkarampudi
committed
81400e6