Fix GitHub Actions workflow security issues (zizmor audit)

- Pin internal workflow references to specific commit hashes
- Replace secrets: inherit with explicit secret mappings
- Add concurrency limits to all workflows to prevent overlapping runs
- Add descriptive job names for better CI/CD visibility
- Add explanatory comments for all permission blocks
- Add explicit permissions block to cx-one-scan workflow
- Improve overall security posture of GitHub Actions workflows

All zizmor security audits now pass with zero findings.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

Author: cx-atish-jadhav

.github/workflows/ci.yml

@@ -1,16 +1,23 @@
 name: AST Javascript wrapper CI
 
 on: [pull_request]
+
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   integration-tests:
+    name: Run Integration Tests
     runs-on: cx-public-ubuntu-x64
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           lfs: true
+          persist-credentials: false
 
       - name: Install Git LFS
         run: |
@@ -67,4 +74,4 @@ jobs:
           CX_BASE_URI: ${{ secrets.CX_BASE_URI }}
           CX_TENANT: ${{ secrets.CX_TENANT }}
           CX_APIKEY: ${{ secrets.CX_APIKEY }}
-        run: npm test
+        run: npm test

.github/workflows/cx-one-scan.yaml

@@ -1,4 +1,8 @@
 name: cx-one-scan
+
+permissions:
+  contents: read # For reading repository code
+
 on:
   workflow_dispatch:
   pull_request:
@@ -8,13 +12,21 @@ on:
   schedule:
     - cron: '00 5 * * *' # Every day at 05:00
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
     cx-one-scan:
-        name: cx-one-scan
+        name: Checkmarx One Security Scan
         runs-on: cx-public-ubuntu-x64
+        permissions:
+          contents: read # For reading repository code
         steps:
         - name: Checkout
           uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+          with:
+            persist-credentials: false
         - name: Checkmarx One CLI Action
           uses: checkmarx/ast-github-action@9fda4ab4c1b67c35de380552a972a82997d97731 # https://github.com/Checkmarx/ast-github-action/releases/tag/2.0.42
           with:

.github/workflows/delete-packages-and-releases.yml

@@ -16,11 +16,16 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   delete:
+    name: Delete Old Packages and Releases
     permissions:
-      contents: write
-      packages: write
+      contents: write # For deleting releases and tags
+      packages: write # For deleting npm packages
     runs-on: cx-public-ubuntu-x64
     steps:
 

.github/workflows/nightly.yml

@@ -8,11 +8,18 @@ on:
     branches:
       - main
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   nightly:
+    name: Nightly Release Job
     permissions:
-      id-token: write
-      contents: write
-      packages: write
-    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/release.yml@main
-    secrets: inherit
+      id-token: write # For signing artifacts
+      contents: write # For pushing tags and releases
+      packages: write # For publishing packages
+    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/release.yml@abe950ede3b052dfc236f730cf11cc290af53d1c
+    secrets:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}

.github/workflows/release.yml

@@ -47,21 +47,28 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   delete:
+    name: Delete Old Packages and Releases
     permissions:
-      contents: write
-      packages: write
-    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/delete-packages-and-releases.yml@main
+      contents: write # For deleting releases
+      packages: write # For deleting packages
+    uses: Checkmarx/ast-cli-javascript-wrapper/.github/workflows/delete-packages-and-releases.yml@abe950ede3b052dfc236f730cf11cc290af53d1c
     with:
       tag: ${{ inputs.jsTag }}
-    secrets: inherit
+    secrets:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     if: inputs.dev == true
   release:
+    name: Release JavaScript Wrapper
     permissions:
-      id-token: write
-      contents: write
-      packages: write
+      id-token: write # For signing artifacts
+      contents: write # For pushing tags and releases
+      packages: write # For publishing packages
     runs-on: cx-public-ubuntu-x64
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -76,6 +83,7 @@ jobs:
         with:
           fetch-depth: 0
           lfs: true  # Ensure LFS files are checked out
+          persist-credentials: false
 
       # VERIFY SINGLE LOCKFILE
       - name: Verify single lockfile
@@ -185,7 +193,7 @@ jobs:
         if: inputs.dev == false
         run: |
           git pull
-          git tag ${{env.TAG_NAME}}
+          git tag ${TAG_NAME}
           git push --tags
 
 

.github/workflows/update-cli.yml

@@ -1,4 +1,5 @@
 name: Update checkmarx ast cli
+
 on:
   workflow_dispatch:
   repository_dispatch:
@@ -7,15 +8,21 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   update-checkmarx-cli:
+    name: Update Checkmarx CLI Binaries
     permissions:
-      contents: write
+      contents: write # For pushing updated CLI binaries
     runs-on: cx-public-ubuntu-x64
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           lfs: true
+          persist-credentials: false
 
       - name: Install Git LFS
         run: |