Run zizmor static analysis

Author: BehnH

.github/actions/coverage/action.yml

@@ -31,11 +31,14 @@ runs:
     - name: Enforce coverage
       shell: bash
       run: |
-        if [ "${{ steps.test-coverage.outputs.coverage_status }}" != "0" ]; then
+        if [ "${STEPS_TEST_COVERAGE_OUTPUTS_COVERAGE_STATUS}" != "0" ]; then
           echo "Code isn't fully covered!"
-          if [ "${{ inputs.enforce }}" == "true" ]; then
+          if [ "${INPUTS_ENFORCE}" == "true" ]; then
             exit 1
           fi
         else 
           echo "Code is fully covered!"
         fi
+      env:
+        STEPS_TEST_COVERAGE_OUTPUTS_COVERAGE_STATUS: ${{ steps.test-coverage.outputs.coverage_status }}
+        INPUTS_ENFORCE: ${{ inputs.enforce }}

.github/workflows/check-go-versions.yml

@@ -36,8 +36,8 @@ jobs:
     needs: check-go-eol
     runs-on: ubuntu-slim
     env:
-      officialLatestVersion: ${{ needs.check-go-eol.outputs.latest }}
-      officialPenultimateVersion: ${{ needs.check-go-eol.outputs.penultimate }}
+      OFFICIAL_LATEST_VERSION: ${{ needs.check-go-eol.outputs.latest }}
+      OFFICIAL_PENULTIMATE_VERSION: ${{ needs.check-go-eol.outputs.penultimate }}
     steps:
       - uses: actions/checkout@v6
         with:
@@ -48,11 +48,11 @@ jobs:
         run:  cat ./.github/variables/go-versions.env > $GITHUB_OUTPUT
 
       - name: Update go-versions.env and README.md
-        if: steps.go-versions.outputs.latest != env.officialLatestVersion
+        if: steps.go-versions.outputs.latest != env.OFFICIAL_LATEST_VERSION
         id: update-go-versions
         run: |
-          sed -i -e "s#latest=[^ ]*#latest=${{ env.officialLatestVersion }}#g" \
-                 -e "s#penultimate=[^ ]*#penultimate=${{ env.officialPenultimateVersion }}#g" \
+          sed -i -e "s#latest=[^ ]*#latest=${OFFICIAL_LATEST_VERSION}#g" \
+                 -e "s#penultimate=[^ ]*#penultimate=${OFFICIAL_PENULTIMATE_VERSION}#g" \
                   ./.github/variables/go-versions.env
 
       - name: Create GitHub token
@@ -70,11 +70,11 @@ jobs:
           token: ${{ steps.github-token.outputs.token }}
           add-paths: |
             .github/variables/go-versions.env
-          branch: "launchdarklyreleasebot/update-to-go${{ env.officialLatestVersion }}-${{ matrix.branch }}"
+          branch: "launchdarklyreleasebot/update-to-go${{ env.OFFICIAL_LATEST_VERSION }}-${{ matrix.branch }}"
           author: "LaunchDarklyReleaseBot <LaunchDarklyReleaseBot@launchdarkly.com>"
           committer: "LaunchDarklyReleaseBot <LaunchDarklyReleaseBot@launchdarkly.com>"
           labels: ${{ matrix.branch }}
-          title: "fix(deps): bump supported Go versions to ${{ env.officialLatestVersion }} and ${{ env.officialPenultimateVersion }}"
-          commit-message: "Bumps from Go ${{ steps.go-versions.outputs.latest }} -> ${{ env.officialLatestVersion }} and ${{ steps.go-versions.outputs.penultimate }} -> ${{ env.officialPenultimateVersion }}."
+          title: "fix(deps): bump supported Go versions to ${{ env.OFFICIAL_LATEST_VERSION }} and ${{ env.OFFICIAL_PENULTIMATE_VERSION }}"
+          commit-message: "Bumps from Go ${{ steps.go-versions.outputs.latest }} -> ${{ env.OFFICIAL_LATEST_VERSION }} and ${{ steps.go-versions.outputs.penultimate }} -> ${{ env.OFFICIAL_PENULTIMATE_VERSION }}."
           body: |
             - [ ] I have triggered CI on this PR (either close & reopen this PR in Github UI, or `git commit -m "run ci" --allow-empty && git push`)

.github/workflows/go-versions.yml

@@ -36,7 +36,7 @@ on:
 
 jobs:
   go-versions:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     outputs:
       latest: ${{ steps.set-env.outputs.latest }}
       penultimate: ${{ steps.set-env.outputs.penultimate }}
@@ -51,8 +51,12 @@ jobs:
       - name: Set Go Version Matrices
         id: set-matrix
         run: |
-          if [ "${{ steps.set-env.outputs.penultimate }}" == "${{ steps.set-env.outputs.min }}" ]; then
-            echo "all=[\"${{ steps.set-env.outputs.latest }}\",\"${{ steps.set-env.outputs.penultimate }}\"]" >> $GITHUB_OUTPUT
+          if [ "${STEPS_SET_ENV_OUTPUTS_PENULTIMATE}" == "${STEPS_SET_ENV_OUTPUTS_MIN}" ]; then
+            echo "all=[\"${STEPS_SET_ENV_OUTPUTS_LATEST}\",\"${STEPS_SET_ENV_OUTPUTS_PENULTIMATE}\"]" >> $GITHUB_OUTPUT
           else
-            echo "all=[\"${{ steps.set-env.outputs.latest }}\",\"${{ steps.set-env.outputs.penultimate }}\",\"${{ steps.set-env.outputs.min }}\"]" >> $GITHUB_OUTPUT
+            echo "all=[\"${STEPS_SET_ENV_OUTPUTS_LATEST}\",\"${STEPS_SET_ENV_OUTPUTS_PENULTIMATE}\",\"${STEPS_SET_ENV_OUTPUTS_MIN}\"]" >> $GITHUB_OUTPUT
           fi
+        env:
+          STEPS_SET_ENV_OUTPUTS_PENULTIMATE: ${{ steps.set-env.outputs.penultimate }}
+          STEPS_SET_ENV_OUTPUTS_MIN: ${{ steps.set-env.outputs.min }}
+          STEPS_SET_ENV_OUTPUTS_LATEST: ${{ steps.set-env.outputs.latest }}