zizmor: remaining lower-severity GitHub Actions findings

[blarghmatey]

Background

PR #288 added a zizmor security-scanning workflow and pre-commit hook for our GitHub Actions workflows. Both the CI check and the pre-commit hook are gated by --min-severity=high --min-confidence=medium to match zizmor's recommended baseline and avoid blocking on lower-confidence/severity findings.

Running zizmor without any severity/confidence filter surfaces 3 pre-existing findings (all medium severity or below) that are currently gated out. They were not introduced by PR #288 — the scanner just newly surfaced them. Filing this issue to track cleaning them up separately.

GH_TOKEN=$(gh auth token) uvx zizmor --no-progress .github/workflows/

Findings

1. excessive-permissions — .github/workflows/release-ol-spi.yaml:11

• Confidence: Medium
• Job build (lines 11-37) has default permissions since no permissions: block is set.
• https://docs.zizmor.sh/audits/#excessive-permissions

2. archived-uses — .github/workflows/release-ol-spi.yaml:30

• Confidence: High
• Step "Create Release with jar file" uses marvinpinto/action-automatic-releases@d68defdd11f9dcc7f52f35c1b7c236ee7513bcc1 (pinned to latest), whose repository is archived on GitHub. Should be replaced with a maintained alternative (e.g. softprops/action-gh-release).
• https://docs.zizmor.sh/audits/#archived-uses

3. excessive-permissions — .github/workflows/unit-tests.yml:7

• Confidence: Medium
• Job build-and-test (lines 7-32) has default permissions since no permissions: block is set.
• https://docs.zizmor.sh/audits/#excessive-permissions

Notes

These are gated out of both the Run zizmor CI check and the zizmor pre-commit hook by the --min-severity=high --min-confidence=medium thresholds, so they won't block PRs. Addressing them (adding minimal permissions: blocks to the two jobs, and replacing the archived marvinpinto/action-automatic-releases action) is lower-priority hardening.