ci: Resolve GitHub Actions security and fix Zizmor findings for TFX

.github/workflows/cd-docs.yml

@@ -1,27 +1,31 @@
-name: deploy-docs
+name: docs
+
 on:
-  workflow_dispatch:
   push:
     branches:
       - 'master'
   pull_request:
+    branches:
+      - 'master'
+  workflow_dispatch:
+
 permissions:
-  contents: write
+  contents: read
+
 jobs:
-  deploy:
+  build:
+    name: Build docs
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
-
-      - name: Configure Git Credentials
-        run: |
-          git config user.name github-actions[bot]
-          git config user.email 41898282+github-actions[bot]@users.noreply.github.com
-        if: (github.event_name != 'pull_request')
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python 3.10
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
           python-version: '3.10'
           cache: 'pip'
@@ -30,24 +34,8 @@ jobs:
             tfx/dependencies.py
             requirements-docs.txt
 
-      - name: Save time for cache for mkdocs
-        run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-
-      - name: Caching
-        uses: actions/cache@v4
-        with:
-          key: mkdocs-material-${{ env.cache_id }}
-          path: .cache
-          restore-keys: |
-            mkdocs-material-
-
       - name: Install Dependencies
         run: pip install -r requirements-docs.txt
 
-      - name: Deploy to GitHub Pages
-        run: mkdocs gh-deploy --force
-        if: (github.event_name != 'pull_request')
-
       - name: Build docs to check for errors
         run: mkdocs build
-        if: (github.event_name == 'pull_request')

.github/workflows/ci-lint.yml

@@ -3,31 +3,43 @@ name: pre-commit
 on:
   pull_request:
   push:
-     branches: [master]
+    branches: [master]
+
+permissions:
+  contents: read
 
 jobs:
   pre-commit:
+    name: Pre-commit
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@v4.1.7
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         # Ensure the full history is fetched
         # This is required to run pre-commit on a specific set of commits
         # TODO: Remove this when all the pre-commit issues are fixed
         fetch-depth: 0
-    - uses: actions/setup-python@v5.1.1
+        persist-credentials: false
+    - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: '3.10'
     - name: Determine commit range
       id: commit_range
+      env:
+        EVENT_NAME: ${{ github.event_name }}
+        EVENT_SHA: ${{ github.sha }}
+        PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        EVENT_BEFORE: ${{ github.event.before }}
       run: |
-       echo "TO_REF=${{ github.sha }}" >> $GITHUB_ENV
-        if [ "${{ github.event_name }}" == "pull_request" ]; then
-          echo "FROM_REF=${{ github.event.pull_request.base.sha }}" >> $GITHUB_ENV
+        echo "TO_REF=$EVENT_SHA" >> "$GITHUB_ENV"
+        if [ "$EVENT_NAME" == "pull_request" ]; then
+          echo "FROM_REF=$PR_BASE_SHA" >> "$GITHUB_ENV"
         else
-          echo "FROM_REF=${{ github.event.before }}" >> $GITHUB_ENV
+          echo "FROM_REF=$EVENT_BEFORE" >> "$GITHUB_ENV"
         fi
-    - uses: pre-commit/action@v3.0.1
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
       with:
         # TODO: Remove this when all the pre-commit issues are fixed
         extra_args: --from-ref ${{ env.FROM_REF }} --to-ref ${{ env.TO_REF }}

.github/workflows/ci-test.yml

@@ -10,15 +10,21 @@ on:
       - 'docs/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 env:
   USE_BAZEL_VERSION: "7.7.0"
   # Changed to match tensorflow
   # https://github.com/tensorflow/tensorflow/blob/master/.bazelversion
 
 jobs:
   tests:
+    name: unit-tests
     if: github.actor != 'copybara-service[bot]'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     strategy:
       matrix:
@@ -27,10 +33,12 @@ jobs:
         dependency-selector: ["DEFAULT"]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Free Disk Space (Ubuntu)
-      uses: jlumbroso/free-disk-space@main
+      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
       with:
         tool-cache: false
         android: true
@@ -41,7 +49,7 @@ jobs:
         swap-storage: true
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
       with:
         python-version: ${{ matrix.python-version }}
         cache: 'pip'
@@ -50,7 +58,7 @@ jobs:
           tfx/dependencies.py
 
     - name: Set up Bazel
-      uses: bazel-contrib/setup-bazel@0.8.5
+      uses: bazel-contrib/setup-bazel@e403ad507104847c3539436f64a9e9eecc73eeec # 0.8.5
       with:
         # Avoid downloading Bazel every time.
         bazelisk-cache: true

.github/workflows/csat.yml

@@ -20,16 +20,22 @@ on:
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 jobs:
   welcome:
+    name: Welcome survey
     runs-on: ubuntu-latest
+    # zizmor: ignore[excessive-permissions, undocumented-permissions]
+    permissions:
+      # Required to post CSAT surveys on closed issues
+      issues: write
+      pull-requests: write
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/github-script@v6
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+      - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const script = require('./\.github/workflows/scripts/csat.js')
-            script({github, context})
+            script({github, context})

.github/workflows/scripts/constant.js

@@ -44,4 +44,4 @@ let CONSTANT_VALUES = {
   }
 
 };
-module.exports = CONSTANT_VALUES;
+module.exports = CONSTANT_VALUES;

.github/workflows/scripts/csat.js

@@ -58,4 +58,4 @@ module.exports = async ({ github, context }) => {
             });
         }
     }
-};
+};

.github/workflows/scripts/stale_csat.js

@@ -59,4 +59,4 @@ module.exports = async ({github, context}) => {
       await csat({github, context});
     }
   }
-};
+};

.github/workflows/stale.yml

@@ -22,63 +22,68 @@ name: Mark and close stale PRs/issues
 on:
   schedule:
   - cron: "30 1 * * *"
-
 
 permissions:
   contents: read
-  issues: write
-  pull-requests: write
 
 jobs:
   stale:
-
+    name: Stale issue handler
     runs-on: ubuntu-latest
+    # zizmor: ignore[excessive-permissions, undocumented-permissions]
+    permissions:
+      # Required to triage and close stale issues/PRs
+      contents: read
+      issues: write
+      pull-requests: write
     steps:
-    - uses: actions/stale@v7
+    - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
-        #Comma separated list of labels that can be assigned to issues to exclude them from being marked as stale 
-        exempt-issue-labels: 'override-stale' 
-        #Comma separated list of labels that can be assigned to PRs to exclude them from being marked as stale 
-        exempt-pr-labels: "override-stale" 
-        #Limit the No. of API calls in one run default value is 30. 
-        operations-per-run: 1000 
+        #Comma separated list of labels that can be assigned to issues to exclude them from being marked as stale
+        exempt-issue-labels: 'override-stale'
+        #Comma separated list of labels that can be assigned to PRs to exclude them from being marked as stale
+        exempt-pr-labels: "override-stale"
+        #Limit the No. of API calls in one run default value is 30.
+        operations-per-run: 1000
         # Prevent to remove stale label when PRs or issues are updated.
         remove-stale-when-updated: true
         # List of labels to remove when issues/PRs unstale.
         labels-to-remove-when-unstale: 'stat:awaiting response'
         stale-pr-message: 'This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 5 days'
         days-before-stale: 30
         days-before-close: 5
-        
-        #comment on PR if stale for more then 30 days. 
+
+        #comment on PR if stale for more then 30 days.
         close-pr-message: This PR was closed due to lack of activity after being marked stale for past 30 days.
-        
+
         # comment on issues if not active for more then 7 days.
         stale-issue-message: 'This issue has been marked stale because it has no recent activity since 7 days. It will be closed if no further activity occurs. Thank you.'
-        
-        #comment on issues if stale for more then 7 days. 
+
+        #comment on issues if stale for more then 7 days.
         close-issue-message: 'This issue was closed due to lack of activity after being marked stale for past 7 days.'
-              
-        # reason for closed the issue default value is not_planned 
+
+        # reason for closed the issue default value is not_planned
         close-issue-reason: completed
-        
+
         # Number of days of inactivity before a stale issue is closed
         days-before-issue-close: 7
-        
+
         # Number of days of inactivity before an issue Request becomes stale
         days-before-issue-stale: 7
-                
+
         #Check for label to stale or close the issue/PR
         any-of-labels: 'stat:awaiting response'
-         
+
         #stale label for PRs
         stale-pr-label: 'stale'
 
         #stale label for issues
         stale-issue-label: 'stale'
-    - uses: actions/checkout@v3
-    - uses: actions/github-script@v6
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
+    - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
       with:
         script: |
           const script = require('./\.github/workflows/scripts/stale_csat.js')