Add zizmor and fix its findings

.github/actions/build/build-binaries/action.yml

@@ -115,9 +115,11 @@ runs:
           PATHS_TO_ARCHIVE="$PATHS_TO_ARCHIVE ./docker-images/artifacts/binaries"
         fi
 
-        tar -cvpf binaries-${{ inputs.artifactSuffix }}.tar \
+        tar -cvpf binaries-${INPUTS_ARTIFACTSUFFIX}.tar \
           --exclude='**/surefire-reports' \
           $PATHS_TO_ARCHIVE
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
 
     - name: Upload artifact
       if: ${{ inputs.mainJavaBuild == 'true' }}

.github/actions/build/build-containers/action.yml

@@ -48,7 +48,9 @@ runs:
 
     - name: "Untar binaries archive"
       shell: bash
-      run: tar -xvf binaries-${{ inputs.artifactSuffix }}.tar
+      run: tar -xvf binaries-${INPUTS_ARTIFACTSUFFIX}.tar
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
 
     - name: Build images
       shell: bash
@@ -64,7 +66,11 @@ runs:
 
     - name: Create tarball with images
       shell: bash
-      run: "tar -cvpf containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar ${{ inputs.imagesLocation }}"
+      run: "tar -cvpf containers-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_ARCHITECTURE}.tar ${INPUTS_IMAGESLOCATION}"
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
+        INPUTS_IMAGESLOCATION: ${{ inputs.imagesLocation }}
 
     - name: Upload containers artifact
       uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
@@ -76,4 +82,4 @@ runs:
       if: ${{ always() }}
       shell: bash
       run: |
-        docker images -a
+        docker images -a

.github/actions/build/load-containers/action.yml

@@ -30,11 +30,17 @@ runs:
   steps:
     - name: "Untar ${{ inputs.architecture }} containers"
       shell: bash
-      run: tar -xvf containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar
+      run: tar -xvf containers-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: "Delete the original archive with ${{ inputs.architecture }} containers"
       shell: bash
-      run: rm containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar
+      run: rm containers-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     # This is for loading images into minikube registry
     - name: Load & push images into minikube registry

.github/actions/build/publish-helm-chart/action.yml

@@ -41,18 +41,30 @@ runs:
 
     - name: Extract release artifacts
       shell: bash
-      run: tar -xvf release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar
+      run: tar -xvf release-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_RELEASEVERSION}.tar
+      env:
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
+        INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
 
     - name: Login to OCI registry
       shell: bash
-      run: helm registry login -u ${{ inputs.registryUser }} -p ${{ inputs.registryPassword }} ${{ inputs.containerRegistry }}
+      run: helm registry login -u ${INPUTS_REGISTRYUSER} -p ${INPUTS_REGISTRYPASSWORD} ${INPUTS_CONTAINERREGISTRY}
+      env:
+        INPUTS_REGISTRYUSER: ${{ inputs.registryUser }}
+        INPUTS_REGISTRYPASSWORD: ${{ inputs.registryPassword }}
+        INPUTS_CONTAINERREGISTRY: ${{ inputs.containerRegistry }}
 
     - name: Push Helm Chart to OCI registry
       id: helm-push
       shell: bash
       run: |
-        PUSH_OUTPUT=$(helm push ${{ inputs.helmChartName }}-${{ inputs.releaseVersion }}.tgz oci://${{ inputs.containerRegistry }}/${{ inputs.containerOrg }} 2>&1)
+        PUSH_OUTPUT=$(helm push ${INPUTS_HELMCHARTNAME}-${INPUTS_RELEASEVERSION}.tgz oci://${INPUTS_CONTAINERREGISTRY}/${INPUTS_CONTAINERORG} 2>&1)
         echo "$PUSH_OUTPUT"
         DIGEST=$(echo "$PUSH_OUTPUT" | grep "Digest:" | awk '{print $2}')
         echo "digest=${DIGEST}" >> "$GITHUB_OUTPUT"
-        echo "image=${{ inputs.containerRegistry }}/${{ inputs.containerOrg }}/${{ inputs.helmChartName }}@${DIGEST}" >> "$GITHUB_OUTPUT"
+        echo "image=${INPUTS_CONTAINERREGISTRY}/${INPUTS_CONTAINERORG}/${INPUTS_HELMCHARTNAME}@${DIGEST}" >> "$GITHUB_OUTPUT"
+      env:
+        INPUTS_HELMCHARTNAME: ${{ inputs.helmChartName }}
+        INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
+        INPUTS_CONTAINERREGISTRY: ${{ inputs.containerRegistry }}
+        INPUTS_CONTAINERORG: ${{ inputs.containerOrg }}

.github/actions/build/push-containers/action.yml

@@ -66,20 +66,27 @@ runs:
     - name: Extract container archives
       shell: bash
       run: |
-        IFS=',' read -ra ARCH_ARRAY <<< "${{ inputs.architectures }}"
+        IFS=',' read -ra ARCH_ARRAY <<< "${INPUTS_ARCHITECTURES}"
         for arch in "${ARCH_ARRAY[@]}"; do
-          tar -xvf "containers-${{ inputs.artifactSuffix }}-${arch}.tar"
-          rm "containers-${{ inputs.artifactSuffix }}-${arch}.tar"
+          tar -xvf "containers-${INPUTS_ARTIFACTSUFFIX}-${arch}.tar"
+          rm "containers-${INPUTS_ARTIFACTSUFFIX}-${arch}.tar"
         done
+      env:
+        INPUTS_ARCHITECTURES: ${{ inputs.architectures }}
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
 
     - name: Login to container registry
       shell: bash
-      run: docker login -u ${{ inputs.registryUser }} -p ${{ inputs.registryPassword }} ${{ inputs.containerRegistry }}
+      run: docker login -u ${INPUTS_REGISTRYUSER} -p ${INPUTS_REGISTRYPASSWORD} ${INPUTS_CONTAINERREGISTRY}
+      env:
+        INPUTS_REGISTRYUSER: ${{ inputs.registryUser }}
+        INPUTS_REGISTRYPASSWORD: ${{ inputs.registryPassword }}
+        INPUTS_CONTAINERREGISTRY: ${{ inputs.containerRegistry }}
 
     - name: Push containers and create manifests
       shell: bash
       run: |
-        IFS=',' read -ra ARCH_ARRAY <<< "${{ inputs.architectures }}"
+        IFS=',' read -ra ARCH_ARRAY <<< "${INPUTS_ARCHITECTURES}"
         for arch in "${ARCH_ARRAY[@]}"; do
           echo "Processing architecture: ${arch}"
           export DOCKER_ARCHITECTURE="${arch}"
@@ -91,6 +98,7 @@ runs:
         DOCKER_REGISTRY: ${{ inputs.containerRegistry }}
         DOCKER_ORG: ${{ inputs.containerOrg }}
         DOCKER_TAG: ${{ inputs.containerTag }}
+        INPUTS_ARCHITECTURES: ${{ inputs.architectures }}
 
     - name: Create multi-platform manifests
       shell: bash
@@ -126,7 +134,7 @@ runs:
       if: ${{ github.event_name != 'pull_request' }}
       shell: bash
       run: |
-        IFS=',' read -ra ARCH_ARRAY <<< "${{ inputs.architectures }}"
+        IFS=',' read -ra ARCH_ARRAY <<< "${INPUTS_ARCHITECTURES}"
         for arch in "${ARCH_ARRAY[@]}"; do
           echo "Generating SBOM for architecture: ${arch}"
           export DOCKER_ARCHITECTURE="${arch}"
@@ -138,6 +146,7 @@ runs:
         DOCKER_REGISTRY: ${{ inputs.containerRegistry }}
         DOCKER_ORG: ${{ inputs.containerOrg }}
         DOCKER_TAG: ${{ inputs.containerTag }}
+        INPUTS_ARCHITECTURES: ${{ inputs.architectures }}
 
     # Generates a list of images and it's digest for attestation
     - name: Discover container images for attestation
@@ -148,8 +157,8 @@ runs:
         if [ -d "./sbom" ]; then
           for sbom_file in $(find ./sbom -name "*.json" -type f | sort); do
             relative="${sbom_file#./sbom/}"
-            after_org="${relative#*${{ inputs.containerRegistry }}/${{ inputs.containerOrg }}/}"
-            name="${{ inputs.containerRegistry }}/${{ inputs.containerOrg }}/${after_org%%/*}"
+            after_org="${relative#*${INPUTS_CONTAINERREGISTRY}/${INPUTS_CONTAINERORG}/}"
+            name="${INPUTS_CONTAINERREGISTRY}/${INPUTS_CONTAINERORG}/${after_org%%/*}"
             digest=$(basename "$sbom_file" .json)
             images=$(echo "$images" | jq -c --arg n "$name" --arg d "$digest" --arg s "$relative" \
               '. + [{"name": $n, "digest": $d, "sbom": $s}]')
@@ -158,6 +167,9 @@ runs:
         fi
         echo "images=${images}" >> "$GITHUB_OUTPUT"
         echo "Discovered $(echo "$images" | jq 'length') image(s) for attestation"
+      env:
+        INPUTS_CONTAINERREGISTRY: ${{ inputs.containerRegistry }}
+        INPUTS_CONTAINERORG: ${{ inputs.containerOrg }}
 
     - name: Create SBOM archive
       # This condition is required for properly running the tests
@@ -181,7 +193,7 @@ runs:
       if: ${{ startsWith(github.ref, 'refs/heads/release-') }}
       shell: bash
       run: |
-        IFS=',' read -ra ARCH_ARRAY <<< "${{ inputs.architectures }}"
+        IFS=',' read -ra ARCH_ARRAY <<< "${INPUTS_ARCHITECTURES}"
         for arch in "${ARCH_ARRAY[@]}"; do
           echo "Pushing SBOM for architecture: ${arch}"
           export DOCKER_ARCHITECTURE="${arch}"
@@ -194,4 +206,5 @@ runs:
         BUILD_COMMIT: ${{ github.sha }}
         DOCKER_REGISTRY: ${{ inputs.containerRegistry }}
         DOCKER_ORG: ${{ inputs.containerOrg }}
-        DOCKER_TAG: ${{ inputs.containerTag }}
+        DOCKER_TAG: ${{ inputs.containerTag }}
+        INPUTS_ARCHITECTURES: ${{ inputs.architectures }}

.github/actions/build/release-artifacts/action.yml

@@ -29,11 +29,14 @@ runs:
     - name: Create release tarball
       shell: bash
       run: |
-        find . -type f \( -iname "*${{ inputs.releaseVersion }}*.tar.gz" -o \
-                          -iname "*${{ inputs.releaseVersion }}*.zip" -o \
-                          -iname "*${{ inputs.releaseVersion }}*.tgz" -o \
-                          -iname "*${{ inputs.releaseVersion }}*.yaml" \) \
-          -exec tar -rvf release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar {} \;
+        find . -type f \( -iname "*${INPUTS_RELEASEVERSION}*.tar.gz" -o \
+                          -iname "*${INPUTS_RELEASEVERSION}*.zip" -o \
+                          -iname "*${INPUTS_RELEASEVERSION}*.tgz" -o \
+                          -iname "*${INPUTS_RELEASEVERSION}*.yaml" \) \
+          -exec tar -rvf release-${INPUTS_ARTIFACTSUFFIX}-${INPUTS_RELEASEVERSION}.tar {} \;
+      env:
+        INPUTS_RELEASEVERSION: ${{ inputs.releaseVersion }}
+        INPUTS_ARTIFACTSUFFIX: ${{ inputs.artifactSuffix }}
 
     - name: Upload release artifacts
       uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2

.github/actions/dependencies/install-shellcheck/action.yml

@@ -17,6 +17,7 @@ runs:
     - name: Install shellcheck
       shell: bash
       run: |
-        ${{ github.action_path }}/setup_shellcheck.sh "${{ inputs.architecture }}"
+        ${{ github.action_path }}/setup_shellcheck.sh "${INPUTS_ARCHITECTURE}"
       env:
-        VERSION: ${{ inputs.version }}
+        VERSION: ${{ inputs.version }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}

.github/actions/dependencies/install-syft/action.yml

@@ -17,6 +17,7 @@ runs:
     - name: Install Syft
       shell: bash
       run: |
-        ${{ github.action_path }}/install_syft.sh "${{ inputs.architecture }}"
+        ${{ github.action_path }}/install_syft.sh "${INPUTS_ARCHITECTURE}"
       env:
         VERSION: ${{ inputs.version }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}

.github/actions/dependencies/install-yq/action.yml

@@ -17,6 +17,7 @@ runs:
     - name: Install yq
       shell: bash
       run: |
-        ${{ github.action_path }}/install_yq.sh "${{ inputs.architecture }}"
+        ${{ github.action_path }}/install_yq.sh "${INPUTS_ARCHITECTURE}"
       env:
         VERSION: ${{ inputs.version }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}

.github/actions/dependencies/setup-kind/action.yml

@@ -41,14 +41,19 @@ runs:
       if: steps.cache-registry.outputs.cache-hit == 'true'
       shell: bash
       run: |
-        docker load -i /tmp/registry-image-${{ inputs.architecture }}.tar
+        docker load -i /tmp/registry-image-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Pull and save registry Docker image if cache miss
       if: steps.cache-registry.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        docker pull ${{ inputs.registry }}
-        docker save ${{ inputs.registry }} -o /tmp/registry-image-${{ inputs.architecture }}.tar
+        docker pull ${INPUTS_REGISTRY}
+        docker save ${INPUTS_REGISTRY} -o /tmp/registry-image-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_REGISTRY: ${{ inputs.registry }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Cache cloud-provider-kind container image
       id: cache-cloud-provider-kind
@@ -61,39 +66,49 @@ runs:
       if: steps.cache-cloud-provider-kind.outputs.cache-hit == 'true'
       shell: bash
       run: |
-        docker load -i /tmp/cloud-provider-kind-image-${{ inputs.architecture }}.tar
+        docker load -i /tmp/cloud-provider-kind-image-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Pull and save cloud-provider-kind container image if cache miss
       if: steps.cache-cloud-provider-kind.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        docker pull registry.k8s.io/cloud-provider-kind/cloud-controller-manager:v${{ inputs.cloudProviderVersion }}
-        docker save registry.k8s.io/cloud-provider-kind/cloud-controller-manager:v${{ inputs.cloudProviderVersion }} -o /tmp/cloud-provider-kind-image-${{ inputs.architecture }}.tar
+        docker pull registry.k8s.io/cloud-provider-kind/cloud-controller-manager:v${INPUTS_CLOUDPROVIDERVERSION}
+        docker save registry.k8s.io/cloud-provider-kind/cloud-controller-manager:v${INPUTS_CLOUDPROVIDERVERSION} -o /tmp/cloud-provider-kind-image-${INPUTS_ARCHITECTURE}.tar
+      env:
+        INPUTS_CLOUDPROVIDERVERSION: ${{ inputs.cloudProviderVersion }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Setup Kind
       shell: bash
       run: |
-        ${{ github.action_path }}/setup-kind.sh "${{ inputs.architecture }}"
+        ${{ github.action_path }}/setup-kind.sh "${INPUTS_ARCHITECTURE}"
       env:
         REGISTRY_IMAGE: ${{ inputs.registry }}
         CONTROL_NODES: ${{ inputs.controlNodes }}
         WORKER_NODES: ${{ inputs.workerNodes }}
         KIND_CLOUD_PROVIDER_VERSION: v${{ inputs.cloudProviderVersion }}
         KIND_VERSION: v${{ inputs.kindVersion }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Set DOCKER_REGISTRY
       shell: bash
-      run: |
+      # Exporting the registry address to the calling job is the purpose of this step;
+      # the value comes from the runner or cluster, not from user input
+      run: | # zizmor: ignore[github-env]
         echo "DOCKER_REGISTRY=$(hostname --all-ip-addresses | awk '{ print $1 }'):5001" >> $GITHUB_ENV
 
     # This is used for building connect image used withing STs for runs where already existing images are used (releases)
     - name: Set CONNECT_BUILD_REGISTRY
       shell: bash
-      run: |
+      # Exporting the registry address to the calling job is the purpose of this step;
+      # the value comes from the runner or cluster, not from user input
+      run: | # zizmor: ignore[github-env]
         echo "CONNECT_BUILD_REGISTRY=$(hostname --all-ip-addresses | awk '{ print $1 }'):5001" >> $GITHUB_ENV
 
     - name: Print registry values
       shell: bash
       run: |
         echo "DOCKER_REGISTRY=${DOCKER_REGISTRY}"
-        echo "CONNECT_BUILD_REGISTRY=${CONNECT_BUILD_REGISTRY}"
+        echo "CONNECT_BUILD_REGISTRY=${CONNECT_BUILD_REGISTRY}"

.github/actions/dependencies/setup-minikube/action.yml

@@ -39,13 +39,15 @@ runs:
       if: steps.cache-registry.outputs.cache-hit != 'true'
       shell: bash
       run: |
-        docker pull ${{ inputs.registry }}
-        docker save ${{ inputs.registry }} -o /tmp/registry-image.tar
+        docker pull ${INPUTS_REGISTRY}
+        docker save ${INPUTS_REGISTRY} -o /tmp/registry-image.tar
+      env:
+        INPUTS_REGISTRY: ${{ inputs.registry }}
 
     - name: Setup Minikube
       shell: bash
       run: |
-        ${{ github.action_path }}/setup-minikube.sh "${{ inputs.architecture }}"
+        ${{ github.action_path }}/setup-minikube.sh "${INPUTS_ARCHITECTURE}"
 
       env:
         TEST_CLUSTER: minikube
@@ -54,6 +56,7 @@ runs:
         TEST_MINIKUBE_VERSION: ${{ inputs.minikubeVersion }}
         REGISTRY_IMAGE: ${{ inputs.registry }}
         RETRIES: ${{ inputs.retries }}
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Set DOCKER_REGISTRY
       shell: bash
@@ -63,7 +66,9 @@ runs:
     # This is used for building connect image used withing STs for runs where already existing images are used (releases)
     - name: Set CONNECT_BUILD_REGISTRY
       shell: bash
-      run: |
+      # Exporting the registry address to the calling job is the purpose of this step;
+      # the value comes from the runner or cluster, not from user input
+      run: | # zizmor: ignore[github-env]
         echo "CONNECT_BUILD_REGISTRY=$(kubectl get service registry -n kube-system -o=jsonpath='{.spec.clusterIP}'):80" >> $GITHUB_ENV
 
     - name: DEBUG - check running containers