ci(security): resolve all Zizmor audit warnings in dependabot and workflow triggers

[dhc-tech]

Add 7-day cooldown to Dependabot and use safe pull_request trigger to achieve 0 open security findings in Zizmor.

Summary by Sourcery

Harden GitHub Actions and Dependabot configuration to eliminate Zizmor security findings while improving pull request automation safety.

Bug Fixes:

• Harden workflow triggers and Dependabot automation to resolve Zizmor security findings.

Enhancements:

• Add a seven-day Dependabot cooldown across all update configurations.
• Improve pull request metadata handling by using Sourcery check results and removing autosubmit labels when pull requests are blocked or failing.
• Replace pull_request_target triggers with pull_request where applicable and update pinned GitHub Actions references.

CI:

• Update GitHub Actions workflow security and dependency configurations to eliminate open Zizmor audit warnings.

[sourcery-ai]

Reviewer's Guide

The PR reduces automation security findings by adding Dependabot cooldowns, moving eligible workflows from pull_request_target to pull_request with narrower permissions, tightening Dependabot author checks, and updating PR metadata logic to consume Sourcery check results and remove autosubmit when validation is not passing; pinned action SHAs are also refreshed.

Sequence diagram for safer pull request metadata validation

sequenceDiagram
    participant GitHub
    participant PRMetadata as PR_Metadata_Workflow
    participant ChecksAPI as GitHub_Checks_API
    participant LabelsAPI as GitHub_Labels_API

    GitHub->>PRMetadata: pull_request event
    PRMetadata->>ChecksAPI: checks.listForRef(pr.head.sha)
    ChecksAPI-->>PRMetadata: Sourcery check run and CI check runs
    PRMetadata->>PRMetadata: evaluate review states and check conclusions
    PRMetadata->>LabelsAPI: set status label
    alt changes requested, CI failed, or PR blocked
        PRMetadata->>LabelsAPI: removeLabel(autosubmit)
    end

Loading

File-Level Changes

Change	Details	Files
Adds a seven-day Dependabot cooldown across all update configurations to reduce update churn and improve dependency-update safety.	Applies the default cooldown to each package, tool, and GitHub Actions update block.	.github/dependabot.yml
Hardens pull-request automation by replacing privileged pull_request_target execution with pull_request triggers and tightening Dependabot validation.	Switches title and label workflows to pull_request events. Adjusts permissions for title validation and retains write access only where labeling requires it. Validates the pull request author rather than the event actor for Dependabot auto-merge.	.github/workflows/pr-title.yml .github/workflows/pull_request_label.yml .github/workflows/dependabot-auto-merge.yml
Improves PR metadata status handling by using Sourcery’s check-run result and automatically disabling autosubmit for blocked or failing PRs.	Detects Sourcery failures through the Checks API instead of parsing review comments. Removes the autosubmit label for changes-requested, CI-failed, or blocked statuses.	.github/workflows/pr-metadata.yml
Refreshes pinned GitHub Actions revisions while preserving immutable SHA pinning.	Updates checkout references across release, validation, dependency, issue, batch-release, sync, and security workflows. Updates the labeler and dependency-review action revisions.	.github/workflows/batch_release_pr.yml .github/workflows/dependency-review.yml .github/workflows/issue-labeler.yml .github/workflows/pull_request_label.yml .github/workflows/release.yml .github/workflows/reusable_release.yml .github/workflows/sync_release_pr.yml .github/workflows/validate.yml .github/workflows/zizmor.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".github/workflows/dependabot-auto-merge.yml" line_range="19" />
<code_context>

 on:
-  pull_request_target:
+  pull_request:
     types: [opened, synchronize, reopened]

</code_context>
<issue_to_address>
**issue (broader_impact):** The auto-merge job runs with a read-only `GITHUB_TOKEN` for Dependabot-triggered `pull_request` workflows, so `gh pr merge --auto` cannot enable auto-merge and fails with a permissions error.

**Triggers:** When a Dependabot patch or minor update reaches the auto-merge step.

**Suggested fix:** Use a privileged `workflow_run` follow-up or a GitHub App/PAT with pull-request write access; alternatively retain `pull_request_target` while ensuring the workflow performs no untrusted checkout or execution.

```suggestion
  pull_request_target:
```
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 1 finding to address first, and this changes the dependency-update policy for every configured ecosystem and moves the auto-merge workflow across a pull-request trust boundary. If either decision is wrong, security updates may be delayed or the workflow may stop receiving the permissions and events it relies on; reverting restores the configuration, but does not recover any exposure or missed updates during the interval.

Blocking findings: .github/workflows/dependabot-auto-merge.yml:19

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[github-actions]

@sourcery-ai review

[github-actions]

@sourcery-ai review

[github-actions]

@sourcery-ai review

[dhc-tech]

@sourcery-ai review

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

Sourcery assessment

Needs a human reviewer. The workflow trigger and permission changes alter the GitHub Actions trust boundary, while the PR metadata and auto-merge logic can change labels and merge-related decisions. If incorrect, fork PRs may lose required automation or an unintended PR could be treated as Dependabot-authored; reverting restores future behavior but does not repair decisions or labels already affected.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}