Fix qlty warnings in workflows

.github/workflows/core.yml

@@ -18,6 +18,12 @@ jobs:
   lit:
     runs-on: ubuntu-24.04
 
+    permissions:
+      checks: write
+      contents: read
+      issues: read
+      pull-requests: write
+
     env:
       ARM_UBL_ACTIVATION_CODE: ${{ secrets.ARM_UBL_ACTIVATION_CODE }}
       CLANG_TI_VERSION: "5.1.0.LTS"
@@ -27,6 +33,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-python@v7
         with:
@@ -51,16 +59,16 @@ jobs:
           sudo ln -s /usr/bin/FileCheck-18 /usr/bin/FileCheck
 
       - name: Activate vcpkg environment
-        uses: ARM-software/cmsis-actions/vcpkg@v1
+        uses: ARM-software/cmsis-actions/vcpkg@8a50b77681a484568e08f31fb7c2285c4735f682 # v1
         with:
           config: ./CMSIS/Core/Test/vcpkg-configuration.json
 
       - name: Activate Arm tool license
-        uses: ARM-software/cmsis-actions/armlm@v1
+        uses: ARM-software/cmsis-actions/armlm@8a50b77681a484568e08f31fb7c2285c4735f682 # v1
         with:
           code: "${{ env.ARM_UBL_ACTIVATION_CODE }}"
 
-      - uses: ammaraskar/gcc-problem-matcher@master
+      - uses: ammaraskar/gcc-problem-matcher@cb2e3f949c41b7818628f35f8484a9b0acf90cf9 # master
 
       - name: Set TI ARM CLANG Environment Variables and Path
         run: |
@@ -93,7 +101,7 @@ jobs:
 
       - name: Publish Test Results
         if: ${{ !cancelled() }}
-        uses: EnricoMi/publish-unit-test-result-action@v2
+        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
         with:
           report_individual_runs: true
           files: ./CMSIS/Core/Test/*.xunit

.github/workflows/corevalidation-report.yml

@@ -1,41 +1,42 @@
 name: Publish CoreValidation Results
 
 on:
-  workflow_run:
+  workflow_run: # zizmor: ignore[dangerous-triggers]
     workflows: ["CoreValidation"]
     # avoid running once merged on main branch, this should be run only on PRs
     branches-ignore: ["main"]
     types:
       - completed
 
+permissions: {}
+
 jobs:
   publish-test-results:
     name: Publish Test Results
     runs-on: ubuntu-24.04
-    if: github.event.workflow_run.conclusion != 'skipped'
+    if: github.event.workflow_run.event == 'pull_request' && github.event.workflow_run.conclusion != 'skipped'
+
+    permissions:
+      actions: read
+      checks: write
+      contents: read
+      issues: read
+      pull-requests: write
 
     steps:
       - name: Download and Extract Artifacts
         env:
-          GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
+          GH_REPO: ${{ github.repository }}
+          GH_TOKEN: ${{ github.token }}
+          RUN_ID: ${{ github.event.workflow_run.id }}
         run: |
-           mkdir -p artifacts && cd artifacts
-
-           artifacts_url=${{ github.event.workflow_run.artifacts_url }}
-
-           gh api "$artifacts_url" -q '.artifacts[] | [.name, .archive_download_url] | @tsv' | while read artifact
-           do
-             IFS=$'\t' read name url <<< "$artifact"
-             gh api $url > "$name.zip"
-             unzip -d "$name" "$name.zip"
-           done
+          gh run download "$RUN_ID" --repo "$GH_REPO" --dir artifacts
 
       - name: Publish Test Results
-        uses: EnricoMi/publish-unit-test-result-action@v2
+        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2
         with:
           commit: ${{ github.event.workflow_run.head_sha }}
           event_file: artifacts/EventFile/event.json
           report_individual_runs: true
           event_name: ${{ github.event.workflow_run.event }}
           files: "artifacts/**/*.junit"
-

.github/workflows/corevalidation.yml

@@ -15,8 +15,16 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   build-and-run:
+
+    permissions:
+      actions: read
+      contents: read
+      packages: read
+      security-events: write
 
     strategy:
       fail-fast: true
@@ -35,6 +43,8 @@ jobs:
     steps:
 
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - working-directory: /home/runner
         env:
@@ -71,12 +81,12 @@ jobs:
           sudo apt-get install libtinfo6
 
       - name: Activate vcpkg environment
-        uses: ARM-software/cmsis-actions/vcpkg@v1
+        uses: ARM-software/cmsis-actions/vcpkg@8a50b77681a484568e08f31fb7c2285c4735f682 # v1
         with:
           config: ./CMSIS/CoreValidation/Project/vcpkg-configuration.json
 
       - name: Activate Arm tool license
-        uses: ARM-software/cmsis-actions/armlm@v1
+        uses: ARM-software/cmsis-actions/armlm@8a50b77681a484568e08f31fb7c2285c4735f682 # v1
         with:
           code: "${{ env.ARM_UBL_ACTIVATION_CODE }}"
 
@@ -87,7 +97,7 @@ jobs:
           languages: cpp
           queries: security-and-quality
 
-      - uses: ammaraskar/gcc-problem-matcher@master
+      - uses: ammaraskar/gcc-problem-matcher@cb2e3f949c41b7818628f35f8484a9b0acf90cf9 # master
         if: matrix.compiler == 'Clang' || matrix.compiler == 'Clang_TI' || matrix.compiler == 'GCC'
 
       - name: Set TI Arm Clang Environment Variables and Path
@@ -145,6 +155,7 @@ jobs:
   event-file:
     needs: [build-and-run]
     runs-on: ubuntu-latest
+    permissions: {}
     steps:
       - name: Archive event file
         if: ${{ !cancelled() }}

.github/workflows/gh-pages.yml

@@ -31,6 +31,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Setup Pages
         uses: actions/configure-pages@v6

.github/workflows/pack.yml

@@ -15,8 +15,12 @@ jobs:
   pack:
     name: Generate pack
     runs-on: ubuntu-24.04
+    permissions:
+      actions: write
+      contents: write
     steps:
-      - uses: actions/checkout@v7
+      # The pack action needs the checkout credential to update release tags.
+      - uses: actions/checkout@v7 # zizmor: ignore[artipacked]
         with:
           fetch-depth: 0
 
@@ -25,7 +29,7 @@ jobs:
         run: |
           git fetch --tags --force
 
-      - uses: Open-CMSIS-Pack/gen-pack-action@main
+      - uses: Open-CMSIS-Pack/gen-pack-action@9cab2ab138e909e93a3f051ab9a4675b52843a25 # main
         with:
           doxygen-version: 1.9.6
           packchk-version: 1.4.1