Lock down github action permissions

[KevinMind]

Fixes: mozilla/addons#15312

Description

• Lock down top level workflow permissions to {} (empty)
• Add permissions back until all jobs pass
• Add linting for security holes in GHA workflows

Context

By locking down default permissions and adding them back on a job or even step level gives us the most granular and limited by default security model for GHA.

Ensuring a step/job/workflow can only do what it intends and should be allowed to do.

Testing

Tests Green

Checklist

• Add #ISSUENUM at the top of your PR to an existing open issue in the mozilla/addons repository.
• Successfully verified the change locally.
• The change is covered by automated tests, or otherwise indicated why doing so is unnecessary/impossible.
• Add before and after screenshots (Only for changes that impact the UI).
• Add or update relevant docs reflecting the changes made.

[Copilot]

Pull Request Overview

Lock down default GitHub Action permissions to {} and apply least-privilege patterns, while updating workflows to pin reusable actions, enforce credential handling, and add linting via Zizmor.

• Added permissions: {} to workflows and called out only the needed secrets per job.
• Pinned local composite actions (context, login-docker, login-gar) to specific SHAs and removed their local definitions.
• Introduced Zizmor linting in docker-compose.tools.yml and updated Makefile to run both Actionlint and Zizmor.

Reviewed Changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
zizmor.yml	Introduce Zizmor lint rule for template injection
docs/topics/development/github_actions.md	Remove outdated docs for composite actions after workflow refactor
docker-compose.tools.yml	Refactor compose file with a base service and two lint services
Makefile-os	Add zizmor target and adjust Actionlint invocation
.github/workflows/*.yml	Add top-level permissions: {}, pin action versions, adjust checkout credentials
.github/actions/build-docker/action.yml	Pin Docker metadata action, streamline env usage for build steps

Comments suppressed due to low confidence (4)

docker-compose.tools.yml:11

• The 'extends' key is not supported in Docker Compose v2+ specs. Consider using YAML anchors (x-extensions) or top-level 'x-' fields to DRY your service definitions instead.

extends: base

.github/workflows/draft_release.yml:78

• Using '<push_hero>' inserts a literal string instead of the variable value. Replace '<push_hero>' with '${push_hero}' to interpolate the input.

template=${template//\{\{GITHUB_USER\}\}/<push_hero>}

.github/actions/build-docker/action.yml:37

• The local 'context' action was removed in this PR. Update this step to pin the remote action (e.g., 'uses: mozilla/addons/.github/actions/context@') or restore the local definition.

uses: ./.github/actions/context

.github/workflows/_health_check.yml:32

• Changing the 'environment' inputs from 'production' to 'prod' is a breaking change for any callers. Ensure all workflow_call consumers and documentation are updated to the new keys.

- prod

[KevinMind]

Stable.

[diox]

Why is this block commented?

[KevinMind]

I wanted to prevent actually sending any notifications. I will unblock now, though this won't run until after the PR lands.. technically possible to switch things up so that it would but it could trigger a dev deployment and probably not worth it.

[KevinMind]

Added dry_run so we can see what is passed to the action without actually sending a notification in slack. working on the latest push of this branch