From 87fb2d5c60b5d1d85d69b10fba28b3bdfa8536c9 Mon Sep 17 00:00:00 2001
From: crazyracer98 <8631139+crazyracer98@users.noreply.github.com>
Date: Sat, 31 Oct 2026 08:51:38 +0000
Subject: [PATCH] fix(ci): satisfy zizmor in features.yml (artipacked,
 dangerous-triggers, adhoc-packages) (DF-S)

- docs checkout: persist-credentials false; the token goes to the git calls that talk to the remote only, as an extraheader

- workflow_run: zizmor ignore[dangerous-triggers] with the guard reasoning

- npm install of @devcontainers/cli: ignore[adhoc-packages], exact-pinned via env
---
 .github/workflows/features.yml | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/features.yml b/.github/workflows/features.yml
index cabf977..8be23b4 100644
--- a/.github/workflows/features.yml
+++ b/.github/workflows/features.yml
@@ -20,7 +20,11 @@ on:
     branches: [main]
   pull_request:
   workflow_dispatch:
-  workflow_run:
+  # Safe: the docs job runs only for a successful, dispatched Release run on
+  # main in this repo (path, event, branch and repository checked in its
+  # `if:`), so the SHA it checks out is trusted main code; head_sha reaches
+  # the shell only through env. Remove this ignore if those guards loosen.
+  workflow_run: # zizmor: ignore[dangerous-triggers]
     workflows: [Release]
     types: [completed]
 
@@ -145,7 +149,7 @@ jobs:
           persist-credentials: false
 
       - name: Install the Dev Container CLI
-        run: npm install --global --ignore-scripts --no-audit --no-fund "@devcontainers/cli@${DEVCONTAINER_CLI_VERSION}"
+        run: npm install --global --ignore-scripts --no-audit --no-fund "@devcontainers/cli@${DEVCONTAINER_CLI_VERSION}" # zizmor: ignore[adhoc-packages] exact-pinned via DEVCONTAINER_CLI_VERSION (Renovate bumps it)
 
       # An "image" scenario gets the matrix image; a "build" scenario gets
       # it as the BASE_IMAGE build arg (its Dockerfile starts with
@@ -203,7 +207,7 @@ jobs:
           persist-credentials: false
 
       - name: Install the Dev Container CLI
-        run: npm install --global --ignore-scripts --no-audit --no-fund "@devcontainers/cli@${DEVCONTAINER_CLI_VERSION}"
+        run: npm install --global --ignore-scripts --no-audit --no-fund "@devcontainers/cli@${DEVCONTAINER_CLI_VERSION}" # zizmor: ignore[adhoc-packages] exact-pinned via DEVCONTAINER_CLI_VERSION (Renovate bumps it)
 
       - name: Point the scenarios at ${{ matrix.image }}
         run: |
@@ -280,6 +284,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
+          # The token is passed to the push step explicitly instead.
+          persist-credentials: false
 
       - name: Generate the feature READMEs
         if: steps.release.outputs.tag != ''
@@ -301,10 +307,16 @@ jobs:
             exit 0
           fi
           branch="automated-docs-update-${TAG}"
+          # The checkout doesn't persist credentials; hand the token to the
+          # git calls that talk to the remote only, as an HTTP header git
+          # doesn't print.
+          auth="$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)"
+          echo "::add-mask::${auth}"
+          git_remote=(git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth}")
           # A re-run of the Release run fires this job again: skip when the
           # branch exists, or a PR from it was ever opened (its branch may be
           # deleted after the merge).
-          if git ls-remote --exit-code --heads origin "$branch" >/dev/null; then
+          if "${git_remote[@]}" ls-remote --exit-code --heads origin "$branch" >/dev/null; then
             echo "Branch ${branch} already exists (a re-run); not opening another PR."
             exit 0
           fi
@@ -317,6 +329,6 @@ jobs:
           git switch -c "$branch"
           git add -- 'src/*/README.md'
           git commit -m "docs: regenerate feature READMEs for ${TAG}"
-          git push origin "$branch"
+          "${git_remote[@]}" push origin "$branch"
           gh pr create --base main --head "$branch" --title "docs: regenerate feature READMEs for ${TAG}" \
             --body "Generated by devcontainers/action generate-docs in features.yml after release ${TAG}."