ci: harden workflows and update references after repo migration

.codex-plugin/plugin.json

@@ -7,7 +7,7 @@
     "email": "data-cloud-ai-integrations@google.com"
   },
   "homepage": "https://cloud.google.com/bigquery",
-  "repository": "https://github.com/gemini-cli-extensions/bigquery-data-analytics",
+  "repository": "https://github.com/GoogleCloudPlatform/bigquery-data-analytics-plugin",
   "license": "Apache-2.0",
   "keywords": [
     "bigquery",

.github/CODEOWNERS

@@ -3,4 +3,4 @@
 # For syntax help see
 # <https://help.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners#codeowners-syntax>
 
-* @gemini-cli-extensions/senseai-eco @gemini-cli-extensions/bigquery-maintainers
+* @GoogleCloudPlatform/senseai-eco @GoogleCloudPlatform/bigquery-data-analytics-plugin-maintainers

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -30,7 +30,7 @@ body:
       label: Pre-reqs
       description: |
         Please run through the following list and make sure you've tried the usual "quick fixes":
-        - Search the [current open issues](https://github.com/gemini-cli-extensions/bigquery-data-analytics/issues)
+        - Search the [current open issues](https://github.com/GoogleCloudPlatform/bigquery-data-analytics-plugin/issues)
         - Update to the latest version of the extension and [Gemini CLI](https://github.com/google-gemini/gemini-cli?tab=readme-ov-file#stable)
       options: 
         - label: "I've searched the current open issues"

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -30,7 +30,7 @@ body:
       description: |
         Please run through the following list and make sure you've tried the usual "quick fixes":
       options:
-        - label: "Search the [current open issues](https://github.com/gemini-cli-extensions/bigquery-data-analytics/issues)"
+        - label: "Search the [current open issues](https://github.com/GoogleCloudPlatform/bigquery-data-analytics-plugin/issues)"
           required: true
 
   - type: textarea

.github/ISSUE_TEMPLATE/question.yml

@@ -30,7 +30,7 @@ body:
       description: |
         Please run through the following list and make sure you've tried the usual "quick fixes":
       options:
-        - label: "Search the [issues](https://github.com/gemini-cli-extensions/bigquery-data-analytics/issues)"
+        - label: "Search the [issues](https://github.com/GoogleCloudPlatform/bigquery-data-analytics-plugin/issues)"
           required: true
 
   - type: textarea

.github/workflows/assign-prs.yml

@@ -15,8 +15,11 @@
 name: PR assignment
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] - needs write token on fork PRs; never checks out or runs PR code
     types: [opened, edited, reopened]
+    branches: [main]
+
+permissions: {}
 
 jobs:
   auto-assign:

.github/workflows/header-check.yml

@@ -18,13 +18,18 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   license-check:
     name: 'License Header Check'
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Check License Header
         uses: apache/skywalking-eyes/header@de402d804643951e752b645b6e562c188470f68a # main

.github/workflows/json-lint.yml

@@ -18,12 +18,17 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   json-lint:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Run JSON Lint
         run: jq . gemini-extension.json

.github/workflows/markdown-checks.yml

@@ -18,13 +18,18 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   link-check:
     name: Run link check
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Link Checker
         uses: lycheeverse/lychee-action@e7477775783ea5526144ba13e8db5eec57747ce8 # v2.9.0

.github/workflows/pr-title-linter.yml

@@ -17,11 +17,14 @@ name: 'Lint PR Title'
 on:
   pull_request:
 
+permissions:
+  pull-requests: read
+
 jobs:
   main:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/presubmit-tests.yml

@@ -26,6 +26,8 @@ jobs:
     steps:
       - name: Check out code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install Gemini CLI
         run: npm install @google/gemini-cli

.github/workflows/skills-validate-fallback.yml

@@ -19,14 +19,14 @@ on:
     paths-ignore:
       - "skills/**"
   pull_request:
-    paths-ignore:
-      - "skills/**"
-  pull_request_target:
-    types: [labeled]
+    types: [opened, synchronize, reopened, labeled]
     paths-ignore:
       - "skills/**"
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   skills-validate:
     runs-on: ubuntu-latest

.github/workflows/skills-validate.yml

@@ -19,18 +19,20 @@ on:
     paths:
       - "skills/**"
   pull_request:
-    paths:
-      - "skills/**"
-  pull_request_target:
-    types: [labeled]
+    types: [opened, synchronize, reopened, labeled]
     paths:
       - "skills/**"
 
+permissions:
+  contents: read
+
 jobs:
   skills-validate:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7

.github/workflows/sync-labels.yaml

@@ -30,6 +30,8 @@ jobs:
       pull-requests: 'write'
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: micnncim/action-label-syncer@3abd5ab72fda571e69fffd97bd4e0033dd5f495c # v1.3.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.lycheeignore

@@ -1,5 +1,5 @@
-https://github.com/gemini-cli-extensions/bigquery-data-analytics/compare/
+https://github.com/GoogleCloudPlatform/bigquery-data-analytics-plugin/compare/
 https://www.npmjs.com/package/skills
 https://agent-plugins.org/compatible-clients
-https://github.com/gemini-cli-extensions/bigquery-data-analytics/issues
+https://github.com/GoogleCloudPlatform/bigquery-data-analytics-plugin/issues
 https://github.com/GoogleCloudPlatform/bigquery-data-analytics-plugin/compare/