[Frawless]

Type of Change

• Task

Description

Adds zizmor to lint.yml. It runs twice: once reporting all findings to code scanning (SARIF), and once with min-severity: medium, which fails the job.

Fixes for the existing findings:

• template-injection – ${{ }} expressions inside run: scripts moved into env: across actions and workflows.
• github-env – FOSSA and Snyk actions now pass LOADED_IMAGE / FOSSA_URL between their steps as step outputs instead of $GITHUB_ENV. The DOCKER_REGISTRY / CONNECT_BUILD_REGISTRY exports in setup-kind / setup-minikube are intentional and suppressed inline.
• secrets-inherit – removed secrets: inherit from test-integrations.yml (the called workflow uses no secrets).
• artipacked – persist-credentials: false on all checkouts, except release.yml, which pushes tags.
• self-repository is disabled in .github/zizmor.yml, because the tests use this repository's own actions on purpose.

Inputs and outputs of the actions are unchanged. The two low adhoc-packages findings (gem install in install-ascii-doctor) remain reported but do not fail the job.

Checklist

• Update documentation
• Write tests
• Make sure all tests pass
• Try your changes inside a Kubernetes cluster, not just from unit tests
• AI assistance was used to create this PR (see the Strimzi AI policy)

---

_{Stack created with GitHub Stacks CLI • Give Feedback 💬}