Fix MegaLinter CI failures from actionlint and zizmor

.github/workflows/megalinter.yaml

@@ -25,6 +25,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.head_ref || '' }}
+          persist-credentials: false
       - name: MegaLinter
         uses: oxsecurity/megalinter/flavors/documentation@v9
         env:

.github/workflows/semantic-release.yaml

@@ -38,27 +38,26 @@ jobs:
         with:
           app-id: ${{ inputs.GH_SEM_REL_APP_ID }}
           private-key: ${{ secrets.GH_SEM_REL_APP_PEM_FILE }}
+          repositories: ${{ github.repository }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
           token: ${{ steps.gh-app-token.outputs.token || secrets.GITHUB_TOKEN }}
           fetch-depth: 0
+          persist-credentials: true
       - name: Set up Node.js
         uses: actions/setup-node@v7
         with:
           node-version: 'lts/*'
       - name: Install Semantic Release
         env:
           SEMANTIC_RELEASE_PLUGINS: ${{ inputs.semantic_release_plugins }}
-        run: >
-          npm install
-          --ignore-scripts
-          semantic-release
-          conventional-changelog-conventionalcommits
-          @semantic-release/changelog
-          @semantic-release/git
-          semantic-release-major-tag
-          $SEMANTIC_RELEASE_PLUGINS
+        run: |
+          mapfile -t plugins <<< "$SEMANTIC_RELEASE_PLUGINS"
+          npm install --ignore-scripts semantic-release conventional-changelog-conventionalcommits @semantic-release/changelog @semantic-release/git semantic-release-major-tag "${plugins[@]}"
       - name: Verify Semantic Release
         run: npm audit signatures
       - name: Run Semantic Release

.mega-linter.yml

@@ -2,6 +2,8 @@
 ENABLE:
   - ACTION
   - MARKDOWN
+ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
+  - GITHUB_TOKEN
 # CHANGELOG.md is generated by semantic-release
 MARKDOWN_FILTER_REGEX_EXCLUDE: "(CHANGELOG\\.md)"
 SHOW_ELAPSED_TIME: true

zizmor.yaml

@@ -0,0 +1,6 @@
+---
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin