fix: update GitHub Actions workflows to use environment variables for inputs and disable credential persistence

Signed-off-by: Weifeng Wang <[email protected]>

Author: qclaogui

.github/actions/setup-identity/action.yaml

@@ -21,9 +21,15 @@ runs:
       shell: bash
       run: |
         git config --global --add safe.directory '/__w/codelab-monitoring/codelab-monitoring'
-        git config user.name "${{ inputs.name }}"
-        git config user.email "${{ inputs.email }}"
+        git config user.name "${INPUTS_NAME}"
+        git config user.email "${INPUTS_EMAIL}"
+      env:
+        INPUTS_NAME: ${{ inputs.name }}
+        INPUTS_EMAIL: ${{ inputs.email }}
     - name: Log in with GH CLI
       shell: bash
       run: |
-        echo "${{ inputs.token }}" | gh auth login --with-token
+        echo "${INPUTS_TOKEN}" | gh auth login --with-token
+
+      env:
+        INPUTS_TOKEN: ${{ inputs.token }}

.github/dependabot.yml

@@ -4,9 +4,13 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "gomod"
     directory: "/"
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 2
+    cooldown:
+      default-days: 7

.github/workflows/ci.yml

@@ -14,9 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/[email protected]
+      with:
+        persist-credentials: false
     - uses: actions/setup-go@v6
       with:
         go-version: '1.25'
 
     - name: Build binary
-      run: make build
+      run: make build

.github/workflows/publish-release.yml

@@ -16,6 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v4.2.2
+        with:
+          persist-credentials: false
       - 
         name: Set variables
         id: vars

.github/workflows/release-drafter.yml

@@ -29,11 +29,16 @@ jobs:
       - 
         name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v4.2.2
+        with:
+          persist-credentials: false
       - 
         name: Copy release notes from Draft
         run: |
-          tag_name=${{ steps.draft.outputs.tag_name }}
-          echo "${{ steps.draft.outputs.body }}" > docs/release_notes/${tag_name:1}.md
+          tag_name=${STEPS_DRAFT_OUTPUTS_TAG_NAME}
+          echo "${STEPS_DRAFT_OUTPUTS_BODY}" > docs/release_notes/${tag_name:1}.md
+        env:
+          STEPS_DRAFT_OUTPUTS_TAG_NAME: ${{ steps.draft.outputs.tag_name }}
+          STEPS_DRAFT_OUTPUTS_BODY: ${{ steps.draft.outputs.body }}
       - 
         name: Upsert Pull Request
         uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 #v8.0.0

.github/workflows/release.yml

@@ -11,6 +11,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v4.2.2
+        with:
+          persist-credentials: false
       - name: Set output
         id: vars
         run: |
@@ -32,4 +34,4 @@ jobs:
     with:
       isPreRelease: ${{ needs.check_tag.outputs.isPreRelease == 'true' }}
     secrets:
-      ghPAT: ${{ secrets.QCBOT_TOKEN }}
+      ghPAT: ${{ secrets.QCBOT_TOKEN }}

.github/workflows/trigger-release.yml

@@ -23,6 +23,7 @@ jobs:
           token: ${{ secrets.QCBOT_TOKEN }}
           # Set fetch-depth: 0 to fetch all history for all branches and tags.
           fetch-depth: 0
+          persist-credentials: false
       - uses: actions/setup-go@v6
         with:
           go-version: '1.25'

.github/workflows/updatecli.yml

@@ -26,6 +26,8 @@ jobs:
             - 
               name: Checkout
               uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v4.2.2
+              with:
+                persist-credentials: false
             - 
               name: Setup updatecli
               uses: updatecli/updatecli-action@v2
@@ -85,6 +87,8 @@ jobs:
             - 
               name: Checkout
               uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #v4.2.2
+              with:
+                persist-credentials: false
             - 
               name: Setup updatecli
               uses: updatecli/updatecli-action@v2