fix: potential CI injections

[erikburt]

Changes

• Updated all references of actions/checkout to use persist-credentials: false
• Fixed basic possible template injection patterns with high severity

Motivation

• Fixing errors as seen from: https://github.com/woodruffw/zizmor

---

https://smartcontract-it.atlassian.net/browse/RE-3341

[jmank88]

Is there a way to do this by default so that we don't have to spam it around everywhere? (and remember to add it in the future for new workflows?)

[rafaelfelix]

afaik the only way to achieve this would be by wrapping actions/checkout in a composite GHA and this as the default.

[erikburt]

^ yeah this would be the only way

[erikburt]

Also, I don't think it matters that much it was an easy remedy to a lot of warning level errors.

I might try and add it to gha-workflow-validator so it will annotate these references to make sure there's persist credentials.

[github-actions]

AER Report: CI Core ran successfully ✅

aer_workflow , commit

AER Report: Operator UI CI ran successfully ✅

aer_workflow , commit

[cl-sonarqube-production]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarQube