From 1b1deb2122589723951c9c5c8411f7f720df5e22 Mon Sep 17 00:00:00 2001
From: "zizmor-enterprise-analysis[bot]"
 <316478672+zizmor-enterprise-analysis[bot]@users.noreply.github.com>
Date: Wed, 4 Nov 2026 09:37:48 +0100
Subject: [PATCH] fix: 36 vulnerabilities in GitHub Actions

Applied with zizmor 1.32.0 --fix=unsafe-only by BulkZizmorFix.ps1.
---
 .github/workflows/integration-test.yml | 66 ++++++++++++++++----------
 .github/workflows/release.yml          | 10 ++--
 .github/workflows/unit-test.yml        |  4 +-
 3 files changed, 50 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index 7c532e1..e182e3f 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -9,8 +9,10 @@ jobs:
   test: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: ./
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+      with:
+        persist-credentials: false
+    - uses: $/
       id: run_action
       with:
         key: "keyB"
@@ -35,12 +37,16 @@ jobs:
         export_to: log,env,output
     - name: 'Test Actions Parameters'
       run: |
-        test "${{env.env1B}}" = "value1B"
-        test "${{env.env2B}}" = "value2B"
-        test "${{env.env3B}}" = "value3B"
-        test "${{steps.run_action.outputs.env1B}}" = "value1B"
-        test "${{steps.run_action.outputs.env2B}}" = "value2B"
-        test "${{steps.run_action.outputs.env3B}}" = "value3B"
+        test "${env1B}" = "value1B"
+        test "${env2B}" = "value2B"
+        test "${env3B}" = "value3B"
+        test "${STEPS_RUN_ACTION_OUTPUTS_ENV1B}" = "value1B"
+        test "${STEPS_RUN_ACTION_OUTPUTS_ENV2B}" = "value2B"
+        test "${STEPS_RUN_ACTION_OUTPUTS_ENV3B}" = "value3B"
+      env:
+        STEPS_RUN_ACTION_OUTPUTS_ENV1B: ${{steps.run_action.outputs.env1B}}
+        STEPS_RUN_ACTION_OUTPUTS_ENV2B: ${{steps.run_action.outputs.env2B}}
+        STEPS_RUN_ACTION_OUTPUTS_ENV3B: ${{steps.run_action.outputs.env3B}}
   test-readme-example1:
     runs-on: ubuntu-latest
     steps:
@@ -66,7 +72,7 @@ jobs:
             }
           }
     - name: Echo environment
-      run: echo ${{ env.environment }}
+      run: echo ${environment}
   test-readme-example2:
     runs-on: ubuntu-latest
     steps:
@@ -86,13 +92,17 @@ jobs:
         export_to: env,log,output
     - name: Echo environment and output
       run: |
-        echo ${{ env.environment }}
-        echo ${{ steps.export.outputs.environment }}
+        echo ${environment}
+        echo ${STEPS_EXPORT_OUTPUTS_ENVIRONMENT}
+      env:
+        STEPS_EXPORT_OUTPUTS_ENVIRONMENT: ${{ steps.export.outputs.environment }}
   test-readme-example3:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: ./
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+      with:
+        persist-credentials: false
+    - uses: $/
       id: export
       with:
         key: "first"
@@ -111,14 +121,16 @@ jobs:
         mode: first_match
     - name: Echo environment and output
       run: |
-        test "${{ env.env1 }}" = "value1"
-        test "${{ env.env2 }}" = "value2"
-        test "${{ env.env3 }}" = ""
+        test "${env1}" = "value1"
+        test "${env2}" = "value2"
+        test "${env3}" = ""
   test-readme-example4:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: ./
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+      with:
+        persist-credentials: false
+    - uses: $/
       id: export
       with:
         key: "first"
@@ -137,14 +149,16 @@ jobs:
         mode: overwrite
     - name: Echo environment and output
       run: |
-        test "${{ env.env1 }}" = "value1_overwrite"
-        test "${{ env.env2 }}" = "value2"
-        test "${{ env.env3 }}" = "value3"
+        test "${env1}" = "value1_overwrite"
+        test "${env2}" = "value2"
+        test "${env3}" = "value3"
   test-readme-example5:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: ./
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+      with:
+        persist-credentials: false
+    - uses: $/
       id: export
       with:
         key: "first"
@@ -163,6 +177,6 @@ jobs:
         mode: fill
     - name: Echo environment and output
       run: |
-        test "${{ env.env1 }}" = "value1"
-        test "${{ env.env2 }}" = "value2"
-        test "${{ env.env3 }}" = "value3"
+        test "${env1}" = "value1"
+        test "${env2}" = "value2"
+        test "${env3}" = "value3"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bd70503..fb25ad6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+        with:
+          persist-credentials: false
       - run: git fetch --prune --unshallow --tags
       - uses: kanga333/config-value-exporter@main
         id: version
@@ -21,12 +23,14 @@ jobs:
           file: package.json
       - id: tag_check
         run: |
-          git rev-parse v${{steps.version.outputs.result}} 2> /dev/null \
+          git rev-parse v${STEPS_VERSION_OUTPUTS_RESULT} 2> /dev/null \
             || echo 'exist=false' >> $GITHUB_OUTPUT
+        env:
+          STEPS_VERSION_OUTPUTS_RESULT: ${{steps.version.outputs.result}}
       - name: Create Release
         if: steps.tag_check.outputs.exist == 'false'
         id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 797816c..915aa31 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -9,7 +9,9 @@ jobs:
   build_and_test: # make sure build/ci work properly
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+      with:
+        persist-credentials: false
     - run: |
         npm install
         npm run all