Chore: Resolves some zizmor reported code scan findings (#12516)

Co-authored-by: shamoon <4887959+shamoon@users.noreply.github.com>

.github/workflows/ci-backend.yml

@@ -13,10 +13,13 @@ concurrency:
 env:
   DEFAULT_UV_VERSION: "0.10.x"
   NLTK_DATA: "/usr/share/nltk_data"
+permissions: {}
 jobs:
   changes:
     name: Detect Backend Changes
     runs-on: ubuntu-slim
+    permissions:
+      contents: read
     outputs:
       backend_changed: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.backend == 'true' }}
     steps:
@@ -66,6 +69,8 @@ jobs:
     if: needs.changes.outputs.backend_changed == 'true'
     name: "Python ${{ matrix.python-version }}"
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     strategy:
       matrix:
         python-version: ['3.11', '3.12', '3.13', '3.14']
@@ -143,6 +148,8 @@ jobs:
     if: needs.changes.outputs.backend_changed == 'true'
     name: Check project typing
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     env:
       DEFAULT_PYTHON: "3.12"
     steps:

.github/workflows/ci-docker.yml

@@ -89,7 +89,7 @@ jobs:
                 push_external="true"
                 ;;
             esac
-            case "${{ github.ref }}" in
+            case "${GITHUB_REF}" in
               refs/tags/v*|*beta.rc*)
                 push_external="true"
                 ;;
@@ -230,8 +230,10 @@ jobs:
 
           docker buildx imagetools create ${tags} ${digests}
       - name: Inspect image
+        env:
+          FIRST_TAG: ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
         run: |
-          docker buildx imagetools inspect ${{ fromJSON(steps.docker-meta.outputs.json).tags[0] }}
+          docker buildx imagetools inspect "${FIRST_TAG}"
       - name: Copy to Docker Hub
         if: needs.build-arch.outputs.push-external == 'true'
         env:

.github/workflows/ci-docs.yml

@@ -10,8 +10,6 @@ concurrency:
   cancel-in-progress: true
 permissions:
   contents: read
-  pages: write
-  id-token: write
 env:
   DEFAULT_UV_VERSION: "0.10.x"
   DEFAULT_PYTHON_VERSION: "3.12"
@@ -105,6 +103,9 @@ jobs:
     needs: [changes, build]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main' && needs.changes.outputs.docs_changed == 'true'
     runs-on: ubuntu-24.04
+    permissions:
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}

.github/workflows/ci-frontend.yml

@@ -10,10 +10,13 @@ on:
 concurrency:
   group: frontend-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
+permissions: {}
 jobs:
   changes:
     name: Detect Frontend Changes
     runs-on: ubuntu-slim
+    permissions:
+      contents: read
     outputs:
       frontend_changed: ${{ steps.force.outputs.run_all == 'true' || steps.filter.outputs.frontend == 'true' }}
     steps:
@@ -21,6 +24,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Decide run mode
         id: force
         run: |
@@ -59,6 +63,8 @@ jobs:
     if: needs.changes.outputs.frontend_changed == 'true'
     name: Install Dependencies
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -89,6 +95,8 @@ jobs:
     needs: [changes, install-dependencies]
     if: needs.changes.outputs.frontend_changed == 'true'
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -120,6 +128,8 @@ jobs:
     needs: [changes, install-dependencies]
     if: needs.changes.outputs.frontend_changed == 'true'
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -169,6 +179,8 @@ jobs:
     needs: [changes, install-dependencies]
     if: needs.changes.outputs.frontend_changed == 'true'
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     container: mcr.microsoft.com/playwright:v1.58.2-noble
     env:
       PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
@@ -212,6 +224,8 @@ jobs:
     needs: [changes, unit-tests, e2e-tests]
     if: needs.changes.outputs.frontend_changed == 'true'
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/ci-lint.yml

@@ -9,6 +9,8 @@ on:
 concurrency:
   group: lint-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
+permissions:
+  contents: read
 jobs:
   lint:
     name: Linting via prek

.github/workflows/ci-release.yml

@@ -10,10 +10,14 @@ concurrency:
 env:
   DEFAULT_UV_VERSION: "0.10.x"
   DEFAULT_PYTHON_VERSION: "3.12"
+permissions: {}
 jobs:
   wait-for-docker:
     name: Wait for Docker Build
     runs-on: ubuntu-24.04
+    permissions:
+      checks: read
+      statuses: read
     steps:
       - name: Wait for Docker build
         uses: lewagon/wait-on-check-action@74049309dfeff245fe8009a0137eacf28136cb3c # v1.5.0
@@ -26,6 +30,8 @@ jobs:
     name: Build Release
     needs: wait-for-docker
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -40,8 +46,7 @@ jobs:
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 24.x
-          cache: 'pnpm'
-          cache-dependency-path: 'src-ui/pnpm-lock.yaml'
+          package-manager-cache: false
       - name: Install frontend dependencies
         run: cd src-ui && pnpm install
       - name: Build frontend
@@ -56,7 +61,7 @@ jobs:
         uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
         with:
           version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
+          enable-cache: false
           python-version: ${{ steps.setup-python.outputs.python-version }}
       - name: Install Python dependencies
         run: |
@@ -129,6 +134,9 @@ jobs:
     name: Publish Release
     needs: build-release
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      pull-requests: write
     outputs:
       prerelease: ${{ steps.get-version.outputs.prerelease }}
       changelog: ${{ steps.create-release.outputs.body }}
@@ -141,9 +149,11 @@ jobs:
           path: ./
       - name: Get version info
         id: get-version
+        env:
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          echo "version=${{ github.ref_name }}" >> $GITHUB_OUTPUT
-          if [[ "${{ github.ref_name }}" == *"-beta.rc"* ]]; then
+          echo "version=${REF_NAME}" >> $GITHUB_OUTPUT
+          if [[ "${REF_NAME}" == *"-beta.rc"* ]]; then
             echo "prerelease=true" >> $GITHUB_OUTPUT
           else
             echo "prerelease=false" >> $GITHUB_OUTPUT
@@ -176,6 +186,9 @@ jobs:
     needs: publish-release
     if: needs.publish-release.outputs.prerelease == 'false'
     runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+      pull-requests: write
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -191,15 +204,17 @@ jobs:
         uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098 # v7.3.1
         with:
           version: ${{ env.DEFAULT_UV_VERSION }}
-          enable-cache: true
+          enable-cache: false
           python-version: ${{ env.DEFAULT_PYTHON_VERSION }}
       - name: Update changelog
         working-directory: docs
+        env:
+          CHANGELOG: ${{ needs.publish-release.outputs.changelog }}
         run: |
           git branch ${{ needs.publish-release.outputs.version }}-changelog
           git checkout ${{ needs.publish-release.outputs.version }}-changelog
 
-          echo -e "# Changelog\n\n${{ needs.publish-release.outputs.changelog }}\n" > changelog-new.md
+          printf '# Changelog\n\n%s\n' "${CHANGELOG}" > changelog-new.md
 
           echo "Manually linking usernames"
           sed -i -r 's|@([a-zA-Z0-9_]+) \(\[#|[@\1](https://github.com/\1) ([#|g' changelog-new.md

.github/workflows/ci-static-analysis.yml

@@ -33,10 +33,18 @@ jobs:
     container:
       image: semgrep/semgrep:1.155.0@sha256:cc869c685dcc0fe497c86258da9f205397d8108e56d21a86082ea4886e52784d
     if: github.actor != 'dependabot[bot]'
+    permissions:
+      contents: read
+      security-events: write
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Run Semgrep
-        run: semgrep scan --config auto
+        run: semgrep scan --config auto --sarif-output results.sarif
+      - name: Upload results to GitHub code scanning
+        uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
+        if: always()
+        with:
+          sarif_file: results.sarif

.github/workflows/cleanup-tags.yml

@@ -12,6 +12,7 @@ on:
 concurrency:
   group: registry-tags-cleanup
   cancel-in-progress: false
+permissions: {}
 jobs:
   cleanup-images:
     name: Cleanup Image Tags for ${{ matrix.primary-name }}

.github/workflows/crowdin.yml

@@ -6,6 +6,9 @@ on:
   push:
     paths: ['src/locale/**', 'src-ui/messages.xlf', 'src-ui/src/locale/**']
     branches: [dev]
+permissions:
+  contents: write
+  pull-requests: write
 jobs:
   synchronize-with-crowdin:
     name: Crowdin Sync

.github/workflows/repo-maintenance.yml

@@ -3,10 +3,6 @@ on:
   schedule:
     - cron: '0 3 * * *'
   workflow_dispatch:
-permissions:
-  issues: write
-  pull-requests: write
-  discussions: write
 concurrency:
   group: lock
 jobs:
@@ -14,6 +10,9 @@ jobs:
     name: 'Stale'
     if: github.repository_owner == 'paperless-ngx'
     runs-on: ubuntu-24.04
+    permissions:
+      issues: write
+      pull-requests: write
     steps:
       - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
@@ -36,6 +35,10 @@ jobs:
     name: 'Lock Old Threads'
     if: github.repository_owner == 'paperless-ngx'
     runs-on: ubuntu-24.04
+    permissions:
+      issues: write
+      pull-requests: write
+      discussions: write
     steps:
       - uses: dessant/lock-threads@7266a7ce5c1df01b1c6db85bf8cd86c737dadbe7 # v6.0.0
         with:
@@ -56,6 +59,8 @@ jobs:
     name: 'Close Answered Discussions'
     if: github.repository_owner == 'paperless-ngx'
     runs-on: ubuntu-24.04
+    permissions:
+      discussions: write
     steps:
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
@@ -113,6 +118,8 @@ jobs:
     name: 'Close Outdated Discussions'
     if: github.repository_owner == 'paperless-ngx'
     runs-on: ubuntu-24.04
+    permissions:
+      discussions: write
     steps:
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
@@ -205,6 +212,8 @@ jobs:
     name: 'Close Unsupported Feature Requests'
     if: github.repository_owner == 'paperless-ngx'
     runs-on: ubuntu-24.04
+    permissions:
+      discussions: write
     steps:
       - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with: