Summary

• Add permissions: {} defaults to workflows missing explicit permissions
• Add persist-credentials: false to all actions/checkout steps
• Move ${{ }} interpolations in run: blocks to env: vars (template injection prevention)
• Replace softprops/action-gh-release with gh release create
• Switch claude-review-maintainer-prs from pull_request_target to pull_request with fork exclusion
• Replace spoofable github.actor check with user.id for dependabot auto-merge
• Add zizmor CI workflow for ongoing monitoring
• Disable uv cache in release workflow (publishes to PyPI)
• Add lookup-only: true to mypy cache

Test plan

• CI passes (linting, type-checking, unit tests, e2e tests)
• zizmor workflow runs clean
• Verify next release workflow still works (persist-credentials + gh auth setup-git)
• add branch protection rule for high severity errors

Fixes https://linear.app/langfuse/issue/LFE-9208/zizmor-python-sdk

🤖 Generated with Claude Code

Disclaimer: Experimental PR review

Greptile Summary

This PR hardens all GitHub Actions workflows against common CI/CD security vulnerabilities identified by zizmor: template injection in run: blocks, over-privileged workflows, spoofable actor checks, and the pull_request_target privilege escalation pattern. The changes are well-scoped and follow established hardening best practices.

• The mypy cache in ci.yml now has lookup-only: true which disables both restore and save, making the cache step a no-op. The # zizmor: ignore[cache-poisoning] comment on the same line already suppresses the linter warning and is sufficient on its own.

Confidence Score: 5/5

• Safe to merge — all findings are P2 style/performance suggestions with no correctness or security impact.
• The single finding (disabled mypy cache) only affects CI performance, not correctness or security. All security hardening changes are correct and well-implemented.
• ci.yml — the lookup-only: true on the mypy cache step.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[release.yml triggered] --> B[Verify branch via GITHUB_REF env]
    B --> C[Confirm major via INPUTS env]
    C --> D[checkout with persist-credentials false]
    D --> E[gh auth login + setup-git\nrestore push credentials]
    E --> F[Calculate version\nall inputs via env vars]
    F --> G[uv build]
    G --> H[git commit + push\nvia gh credential helper]
    H --> I[uv publish to PyPI\nOIDC trusted publishing]
    I --> J[gh release create\nreplaces softprops action]

    K[claude-review workflow] --> L{pull_request trigger\nnot pull_request_target}
    L --> M{head.repo == repository?}
    M -->|same repo| N[Post claude review comment]
    M -->|fork| O[Skip - untrusted context]

    P[dependabot-merge] --> Q{user.id check\nnot actor name}
    Q -->|match| R[Auto-merge patch updates]
    Q -->|no match| S[Skip]

_{Reviews (1): Last reviewed commit: "ci: harden GitHub Actions workflows with..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.