fix(ci): satisfy zizmor in features.yml (DF-S)

.github/workflows/features.yml

@@ -20,7 +20,11 @@ on:
     branches: [main]
   pull_request:
   workflow_dispatch:
-  workflow_run:
+  # Safe: the docs job runs only for a successful, dispatched Release run on
+  # main in this repo (path, event, branch and repository checked in its
+  # `if:`), so the SHA it checks out is trusted main code; head_sha reaches
+  # the shell only through env. Remove this ignore if those guards loosen.
+  workflow_run: # zizmor: ignore[dangerous-triggers]
     workflows: [Release]
     types: [completed]
 
@@ -145,7 +149,7 @@ jobs:
           persist-credentials: false
 
       - name: Install the Dev Container CLI
-        run: npm install --global --ignore-scripts --no-audit --no-fund "@devcontainers/cli@${DEVCONTAINER_CLI_VERSION}"
+        run: npm install --global --ignore-scripts --no-audit --no-fund "@devcontainers/cli@${DEVCONTAINER_CLI_VERSION}" # zizmor: ignore[adhoc-packages] exact-pinned via DEVCONTAINER_CLI_VERSION (Renovate bumps it)
 
       # An "image" scenario gets the matrix image; a "build" scenario gets
       # it as the BASE_IMAGE build arg (its Dockerfile starts with
@@ -203,7 +207,7 @@ jobs:
           persist-credentials: false
 
       - name: Install the Dev Container CLI
-        run: npm install --global --ignore-scripts --no-audit --no-fund "@devcontainers/cli@${DEVCONTAINER_CLI_VERSION}"
+        run: npm install --global --ignore-scripts --no-audit --no-fund "@devcontainers/cli@${DEVCONTAINER_CLI_VERSION}" # zizmor: ignore[adhoc-packages] exact-pinned via DEVCONTAINER_CLI_VERSION (Renovate bumps it)
 
       - name: Point the scenarios at ${{ matrix.image }}
         run: |
@@ -280,6 +284,8 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.workflow_run.head_sha }}
+          # The token is passed to the push step explicitly instead.
+          persist-credentials: false
 
       - name: Generate the feature READMEs
         if: steps.release.outputs.tag != ''
@@ -301,10 +307,16 @@ jobs:
             exit 0
           fi
           branch="automated-docs-update-${TAG}"
+          # The checkout doesn't persist credentials; hand the token to the
+          # git calls that talk to the remote only, as an HTTP header git
+          # doesn't print.
+          auth="$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 -w0)"
+          echo "::add-mask::${auth}"
+          git_remote=(git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic ${auth}")
           # A re-run of the Release run fires this job again: skip when the
           # branch exists, or a PR from it was ever opened (its branch may be
           # deleted after the merge).
-          if git ls-remote --exit-code --heads origin "$branch" >/dev/null; then
+          if "${git_remote[@]}" ls-remote --exit-code --heads origin "$branch" >/dev/null; then
             echo "Branch ${branch} already exists (a re-run); not opening another PR."
             exit 0
           fi
@@ -317,6 +329,6 @@ jobs:
           git switch -c "$branch"
           git add -- 'src/*/README.md'
           git commit -m "docs: regenerate feature READMEs for ${TAG}"
-          git push origin "$branch"
+          "${git_remote[@]}" push origin "$branch"
           gh pr create --base main --head "$branch" --title "docs: regenerate feature READMEs for ${TAG}" \
             --body "Generated by devcontainers/action generate-docs in features.yml after release ${TAG}."