From c9059fe77277d4e14a4f43d49b2cf7dc31957080 Mon Sep 17 00:00:00 2001
From: Christoph Maser <christoph.maser+github@gmail.com>
Date: Mon, 26 Oct 2026 19:17:37 +0100
Subject: [PATCH] ci: address zizmor findings

Signed-off-by: Christoph Maser <christoph.maser+github@gmail.com>
---
 .github/dependabot.yml                  | 4 ++++
 .github/workflows/approve-workflows.yml | 4 +++-
 .github/workflows/ci.yml                | 9 +++++----
 .github/workflows/golangci-lint.yml     | 1 +
 4 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 57d8410442..4c7e6d7e41 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -23,6 +23,8 @@ updates:
       prometheus:
         patterns:
           - "github.com/prometheus/*"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
@@ -42,3 +44,5 @@ updates:
       - .github/workflows/govulncheck.yml
       - .github/workflows/scorecards.yml
       - .github/workflows/stale.yml
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/approve-workflows.yml b/.github/workflows/approve-workflows.yml
index 697118dfc1..75c370c832 100644
--- a/.github/workflows/approve-workflows.yml
+++ b/.github/workflows/approve-workflows.yml
@@ -2,10 +2,12 @@
 ###
 # This action is synced from https://github.com/prometheus/prometheus
 ###
+
 name: Approve pending workflows
 
 on:
-  issue_comment:
+    # The pinned action requires triage access or higher and only calls GitHub APIs.
+  issue_comment: # zizmor: ignore[dangerous-triggers]
     types: [created]
 
 permissions: read-all
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 861450dbdc..edd002a4d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,6 +34,7 @@ jobs:
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: 1.27.x
+          cache: false
       - run: uname -a
       - run: make test-e2e
 
@@ -98,8 +99,8 @@ jobs:
       - uses: prometheus/promci-artifacts/restore@9ca3252d07f230d5f923452b4df5697eba4a5bee # v0.1.1
       - name: Build docker image
         run: |
-          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
-            make docker DOCKER_IMAGE_TAG=${{ github.ref_name }}
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            make docker DOCKER_IMAGE_TAG="${GITHUB_REF_NAME}"
           else
             make docker
           fi
@@ -107,8 +108,8 @@ jobs:
       - run: docker run --rm -t -v "$(pwd):/app" "${DOCKER_TEST_IMAGE_NAME}" -i "${REPO_PATH}" -T
       - name: Test docker image
         run: |
-          if [[ "${{ github.ref }}" == refs/tags/* ]]; then
-            make test-docker DOCKER_IMAGE_TAG=${{ github.ref_name }}
+          if [[ "${GITHUB_REF}" == refs/tags/* ]]; then
+            make test-docker DOCKER_IMAGE_TAG="${GITHUB_REF_NAME}"
           else
             make test-docker
           fi
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index a2d392e188..af01db374b 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -33,6 +33,7 @@ jobs:
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: 1.27.x
+          cache: false
       - name: Install snmp_exporter/generator dependencies
         run: sudo apt-get update && sudo apt-get -y install libsnmp-dev
         if: github.repository == 'prometheus/snmp_exporter'