[ZIZMOR UNSAFE AUTOFIX] fix: 36 vulnerabilities in GitHub Actions

.github/workflows/integration-test.yml

@@ -1,4 +1,4 @@
 name: "integration-test"
 on: # rebuild any PRs and main branch changes
   pull_request:
   push:
@@ -6,11 +6,13 @@
       - master
 
 jobs:
   test: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: ./
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+      with:
+        persist-credentials: false
+    - uses: $/
       id: run_action
       with:
         key: "keyB"
@@ -35,16 +37,20 @@
         export_to: log,env,output
     - name: 'Test Actions Parameters'
       run: |
-        test "${{env.env1B}}" = "value1B"
-        test "${{env.env2B}}" = "value2B"
-        test "${{env.env3B}}" = "value3B"
-        test "${{steps.run_action.outputs.env1B}}" = "value1B"
-        test "${{steps.run_action.outputs.env2B}}" = "value2B"
-        test "${{steps.run_action.outputs.env3B}}" = "value3B"
+        test "${env1B}" = "value1B"
+        test "${env2B}" = "value2B"
+        test "${env3B}" = "value3B"
+        test "${STEPS_RUN_ACTION_OUTPUTS_ENV1B}" = "value1B"
+        test "${STEPS_RUN_ACTION_OUTPUTS_ENV2B}" = "value2B"
+        test "${STEPS_RUN_ACTION_OUTPUTS_ENV3B}" = "value3B"
+      env:
+        STEPS_RUN_ACTION_OUTPUTS_ENV1B: ${{steps.run_action.outputs.env1B}}
+        STEPS_RUN_ACTION_OUTPUTS_ENV2B: ${{steps.run_action.outputs.env2B}}
+        STEPS_RUN_ACTION_OUTPUTS_ENV3B: ${{steps.run_action.outputs.env3B}}
   test-readme-example1:
     runs-on: ubuntu-latest
     steps:
     - uses: kanga333/variable-mapper@master
       with:
         key: "${{github.base_ref}}"
         map: |
@@ -66,11 +72,11 @@
             }
           }
     - name: Echo environment
-      run: echo ${{ env.environment }}
+      run: echo ${environment}
   test-readme-example2:
     runs-on: ubuntu-latest
     steps:
     - uses: kanga333/variable-mapper@master
       id: export
       with:
         key: "${{github.base_ref}}"
@@ -86,13 +92,17 @@
         export_to: env,log,output
     - name: Echo environment and output
       run: |
-        echo ${{ env.environment }}
-        echo ${{ steps.export.outputs.environment }}
+        echo ${environment}
+        echo ${STEPS_EXPORT_OUTPUTS_ENVIRONMENT}
+      env:
+        STEPS_EXPORT_OUTPUTS_ENVIRONMENT: ${{ steps.export.outputs.environment }}
   test-readme-example3:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: ./
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+      with:
+        persist-credentials: false
+    - uses: $/
       id: export
       with:
         key: "first"
@@ -111,14 +121,16 @@
         mode: first_match
     - name: Echo environment and output
       run: |
-        test "${{ env.env1 }}" = "value1"
-        test "${{ env.env2 }}" = "value2"
-        test "${{ env.env3 }}" = ""
+        test "${env1}" = "value1"
+        test "${env2}" = "value2"
+        test "${env3}" = ""
   test-readme-example4:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: ./
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+      with:
+        persist-credentials: false
+    - uses: $/
       id: export
       with:
         key: "first"
@@ -137,14 +149,16 @@
         mode: overwrite
     - name: Echo environment and output
       run: |
-        test "${{ env.env1 }}" = "value1_overwrite"
-        test "${{ env.env2 }}" = "value2"
-        test "${{ env.env3 }}" = "value3"
+        test "${env1}" = "value1_overwrite"
+        test "${env2}" = "value2"
+        test "${env3}" = "value3"
   test-readme-example5:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: ./
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+      with:
+        persist-credentials: false
+    - uses: $/
       id: export
       with:
         key: "first"
@@ -163,6 +177,6 @@
         mode: fill
     - name: Echo environment and output
       run: |
-        test "${{ env.env1 }}" = "value1"
-        test "${{ env.env2 }}" = "value2"
-        test "${{ env.env3 }}" = "value3"
+        test "${env1}" = "value1"
+        test "${env2}" = "value2"
+        test "${env3}" = "value3"

.github/workflows/release.yml

@@ -7,26 +7,30 @@
 
 name: Create Release if version is bumped
 jobs:
   build:
     name: Create Release
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+        with:
+          persist-credentials: false
       - run: git fetch --prune --unshallow --tags
       - uses: kanga333/config-value-exporter@main
         id: version
         with:
           key: version
           file: package.json
       - id: tag_check
         run: |
-          git rev-parse v${{steps.version.outputs.result}} 2> /dev/null \
+          git rev-parse v${STEPS_VERSION_OUTPUTS_RESULT} 2> /dev/null \
             || echo 'exist=false' >> $GITHUB_OUTPUT
+        env:
+          STEPS_VERSION_OUTPUTS_RESULT: ${{steps.version.outputs.result}}
       - name: Create Release
         if: steps.tag_check.outputs.exist == 'false'
         id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:

.github/workflows/unit-test.yml

@@ -6,10 +6,12 @@
       - master
 
 jobs:
   build_and_test: # make sure build/ci work properly
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
+      with:
+        persist-credentials: false
     - run: |
         npm install
         npm run all