ci: fix zizmor security findings

- coverity: remove GITHUB_ENV write; resolve MTL pkg-config path
  inline using export to eliminate environment file injection risk
- cppcheck: fix report dir to use GITHUB_WORKSPACE/reports/ so
  cppcheck results are included in the uploaded artifact
- ci/daily_build/pull_request: move permissions block from workflow
  level to job level for tighter token scoping

Author: dmkarthi

.github/actions/analysis/coverity/action.yml

@@ -9,30 +9,22 @@ description: 'Run Coverity static analysis (assumes Coverity pre-installed on ru
 runs:
   using: composite
   steps:
-    - name: Set up MTL environment
+    - name: Coverity Scan
       shell: bash
       run: |
-        if pkg-config --exists mtl 2>/dev/null; then
-          echo "MTL already discoverable via pkg-config"
-          exit 0
-        fi
-        MTL_PC=$(find /usr /home /opt -name "mtl.pc" 2>/dev/null | head -1)
-        if [ -z "$MTL_PC" ]; then
-          echo "ERROR: MTL pkg-config file not found under /usr, /home, or /opt."
-          echo "Please ensure Media Transport Library is built and installed on the runner."
-          exit 1
+        # Resolve MTL pkg-config path without writing to GITHUB_ENV
+        if ! pkg-config --exists mtl 2>/dev/null; then
+          MTL_PC=$(find /usr /home /opt -name "mtl.pc" 2>/dev/null | head -1)
+          if [ -z "$MTL_PC" ]; then
+            echo "ERROR: MTL pkg-config file not found under /usr, /home, or /opt."
+            echo "Please ensure Media Transport Library is built and installed on the runner."
+            exit 1
+          fi
+          MTL_PC_DIR=$(dirname "$MTL_PC")
+          echo "Found MTL pkgconfig at: $MTL_PC_DIR"
+          export PKG_CONFIG_PATH="${MTL_PC_DIR}:${PKG_CONFIG_PATH:-}"
         fi
-        MTL_PC_DIR=$(dirname "$MTL_PC")
-        echo "Found MTL pkgconfig at: $MTL_PC_DIR"
-        {
-          echo "PKG_CONFIG_PATH<<EOF"
-          echo "${MTL_PC_DIR}:${PKG_CONFIG_PATH}"
-          echo "EOF"
-        } >> "$GITHUB_ENV"
 
-    - name: Coverity Scan
-      shell: bash
-      run: |
         cd "$GITHUB_WORKSPACE"
         REPORT_DIR="$GITHUB_WORKSPACE/reports"
         mkdir -p "$REPORT_DIR"

.github/actions/analysis/cppcheck/action.yml

@@ -12,11 +12,12 @@ runs:
     - name: cppcheck
       shell: bash
       run: |
-        REPORT_DIR="$HOME/static-analysis/${{ github.repository }}/${{ github.run_id }}"
+        REPORT_DIR="$GITHUB_WORKSPACE/reports"
         mkdir -p "$REPORT_DIR"
+        echo "===== cppcheck Static Analysis ====="
         cppcheck \
           --enable=warning,style,performance,portability \
           --std=c11 --force --inline-suppr \
           --suppress=missingIncludeSystem \
           -Iinclude src 2>&1 | tee "$REPORT_DIR/cppcheck-report.txt" || true
-        echo "cppcheck scan complete. Report saved to $REPORT_DIR/cppcheck-report.txt"
+        echo "cppcheck scan complete. Report: $REPORT_DIR/cppcheck-report.txt"

.github/workflows/ci.yml

@@ -14,13 +14,12 @@ on:
       - main
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   ci:
     name: Continuous Integration
     runs-on: self-hosted
+    permissions:
+      contents: read
     steps:
       - name: Clean up previous run
         run: |

.github/workflows/daily_build.yml

@@ -15,14 +15,12 @@ on:
       - main
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   build:
     name: Daily Build
-
     runs-on: self-hosted
+    permissions:
+      contents: read
 
     steps:
       - name: Clean up previous run

.github/workflows/pull_request.yml

@@ -17,13 +17,12 @@ on:
 
   workflow_dispatch:
 
-permissions:
-  contents: read
-
 jobs:
   pull-request:
     name: Pull Request
     runs-on: self-hosted
+    permissions:
+      contents: read
 
     steps:
       - name: Clean up previous run