From 8762c7777c901957101fd30b3ef302cd3aeb4216 Mon Sep 17 00:00:00 2001
From: Joey Perrott <josephperrott@gmail.com>
Date: Fri, 23 Oct 2026 19:16:23 +0000
Subject: [PATCH] build: switch codeql trigger to pull_request and harden
 actions/checkout

Switches .github/workflows/codeql.yml from pull_request_target to pull_request, removes the obsolete zizmor ignore comment, and adds persist-credentials: false to actions/checkout steps in codeql.yml and dev-infra.yml for defense-in-depth.
---
 .github/workflows/codeql.yml    | 5 +++--
 .github/workflows/dev-infra.yml | 6 ++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6f5d275bce..0a223260c2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -2,8 +2,7 @@ name: 'CodeQL'
 
 on:
   push:
-  # zizmor: ignore[dangerous-triggers] - {Trigger is safe as workflow does not checkout untrusted code}
-  pull_request_target:
+  pull_request:
   schedule:
     # Run every Sunday at 12:00
     - cron: '0 12 * * 0'
@@ -27,6 +26,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Initialize CodeQL
         uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
diff --git a/.github/workflows/dev-infra.yml b/.github/workflows/dev-infra.yml
index 5e84cbf429..5158760a77 100644
--- a/.github/workflows/dev-infra.yml
+++ b/.github/workflows/dev-infra.yml
@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./github-actions/labeling/issue
         with:
           angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
@@ -26,6 +28,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./github-actions/labeling/pull-request
         with:
           angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}
@@ -35,6 +39,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./github-actions/post-approval-changes
         with:
           angular-robot-key: ${{ secrets.ANGULAR_ROBOT_PRIVATE_KEY }}