ci: broaden workflow path filter and fix zizmor lint findings (#24323)

## What

The `lint-actions` CI job only ran when `.github/workflows/ci.yaml` or
`.github/actions/**` changed. New workflow files like `backport.yaml`
and `cherry-pick.yaml` were never linted by zizmor, allowing several
findings to land undetected.

## Changes

**`.github/workflows/ci.yaml`** — Broaden the `ci` path filter from
`".github/workflows/ci.yaml"` to `".github/workflows/**"` so
`lint-actions` runs when any workflow file changes.

**`.github/workflows/backport.yaml`**:
- Move permissions from workflow-level to job-level (`detect` →
`contents: read`, `backport` → `contents: write` + `pull-requests:
write`) — fixes `excessive-permissions`
- Replace `${{ matrix.branch }}` in `run:` block with `$BRANCH` env var
— fixes `template-injection`
- Add `persist-credentials: false` to both checkouts — fixes
`artipacked`

**`.github/workflows/cherry-pick.yaml`** — Add `persist-credentials:
false` to checkout — fixes `artipacked`

**`.github/zizmor.yml`** — Ignore `dangerous-triggers` for
`backport.yaml` and `cherry-pick.yaml`. Both use `pull_request_target`
intentionally — they only run post-merge (`merged == true`) and don't
check out or execute untrusted PR code.

.github/workflows/backport.yaml

@@ -21,10 +21,6 @@ on:
       - closed
       - labeled
 
-permissions:
-  contents: write
-  pull-requests: write
-
 # Prevent duplicate runs for the same PR when both 'closed' and 'labeled'
 # fire in quick succession.
 concurrency:
@@ -33,6 +29,8 @@ concurrency:
 jobs:
   detect:
     name: Detect target branches
+    permissions:
+      contents: read
     if: >
       github.event.pull_request.merged == true &&
       contains(github.event.pull_request.labels.*.name, 'backport')
@@ -44,6 +42,7 @@ jobs:
         with:
           # Need all refs to discover release branches.
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Find latest release branches
         id: find
@@ -73,6 +72,9 @@ jobs:
   backport:
     name: "Backport to ${{ matrix.branch }}"
     needs: detect
+    permissions:
+      contents: write
+      pull-requests: write
     if: needs.detect.outputs.branches != '[]'
     runs-on: ubuntu-latest
     strategy:
@@ -85,11 +87,13 @@ jobs:
       PR_URL: ${{ github.event.pull_request.html_url }}
       MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
       SENDER: ${{ github.event.sender.login }}
+      BRANCH: ${{ matrix.branch }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Full history required for cherry-pick.
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Cherry-pick and open PR
         env:
@@ -97,7 +101,11 @@ jobs:
         run: |
           set -euo pipefail
 
-          RELEASE_VERSION="${{ matrix.branch }}"
+          # Configure git to authenticate pushes with the job token
+          # since persist-credentials is disabled on checkout.
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+
+          RELEASE_VERSION="$BRANCH"
           # Strip the release/ prefix for naming.
           VERSION="${RELEASE_VERSION#release/}"
           BACKPORT_BRANCH="backport/${PR_NUMBER}-to-${VERSION}"

.github/workflows/cherry-pick.yaml

@@ -48,6 +48,7 @@ jobs:
         with:
           # Full history required for cherry-pick and branch discovery.
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Cherry-pick and open PR
         env:
@@ -55,6 +56,10 @@ jobs:
         run: |
           set -euo pipefail
 
+          # Configure git to authenticate pushes with the job token
+          # since persist-credentials is disabled on checkout.
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+
           # Find the latest release branch matching the exact release/2.X
           # pattern (no suffixes like release/2.31_hotfix).
           RELEASE_BRANCH=$(

.github/workflows/ci.yaml

@@ -105,7 +105,7 @@ jobs:
               - "scripts/helm.sh"
             ci:
               - ".github/actions/**"
-              - ".github/workflows/ci.yaml"
+              - ".github/workflows/**"
             offlinedocs:
               - "offlinedocs/**"
             tailnet-integration:
@@ -246,8 +246,7 @@ jobs:
     needs: changes
     # Only run this job if changes to CI workflow files are detected. This job
     # can flake as it reaches out to GitHub to check referenced actions.
-    # TODO(#24323): Re-enable once pre-existing zizmor findings are fixed.
-    if: false # needs.changes.outputs.ci == 'true'
+    if: needs.changes.outputs.ci == 'true'
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
     steps:
       - name: Harden Runner

.github/zizmor.yml

@@ -1,4 +1,12 @@
 rules:
   cache-poisoning:
     ignore:
-      - "ci.yaml:184"
+      - "ci.yaml:187"
+  dangerous-triggers:
+    ignore:
+      # Both workflows use pull_request_target intentionally: they need
+      # write access to create backport/cherry-pick branches and PRs.
+      # They only run after merge (merged == true) and do not check out
+      # or execute untrusted PR code.
+      - "backport.yaml"
+      - "cherry-pick.yaml"