Clear the last zizmor findings in the release workflows

[ChrisJBurns]

Follows #6275, which did the same for helm-publish.yml. This clears the last of them: zizmor now reports no findings at all across .github/.

Summary

• create-release-tag.yml — 9 findings → 0. Every expression in a run: block is bound through env:, and the checkout stops persisting credentials.
• releaser.yml ×3 and create-release-pr.yml ×1 — the remaining artipacked findings. Checkouts that kept a credential none of them uses.

Repository total: 13 → 0. The starting point was 111.

This is consistency, not a fix

Seven of the eight template-injection findings are the same value — steps.version.outputs.version — which the job checks against ^[0-9]+\.[0-9]+\.[0-9]+$ before any of these steps run. The eighth pair are steps.check-*.outputs.exists, which the workflow sets itself to the literal true or false. None could carry a shell metacharacter. The genuinely unconstrained value in this file, the Release-Triggered-By commit trailer, was bound in #6272.

Why the checkout changes are safe

None of these three workflows uses the persisted credential:

Workflow	Evidence
create-release-tag.yml	Performs the repository's only git push — but as git push "https://x-access-token:${GH_TOKEN}@github.com/${REPOSITORY}.git". The token is in the remote URL, so .git/config is never consulted.
releaser.yml	Contains no git push, commit or tag. GoReleaser uploads assets through the API with the token it is given, and pushes the Homebrew formula with a separate app token. Two of its three checkouts are in jobs declaring contents: read and could not push regardless.
create-release-pr.yml	Contains no git write either. releaseo is handed the release app token explicitly as an input.

Each change carries a comment recording this, so the next reader does not have to re-derive it.

Deliberately not restructured

The version is bound per-step rather than exported once via $GITHUB_ENV. Six env: blocks repeating one line is more verbose, but moving a value from a step output into the job environment changes how it flows between steps — a refactor of plumbing in workflows no pull request can exercise. An earlier attempt at this file did exactly that and was correctly pushed back on. The verbose version is the safe one.

Part of #6253

Type of change

• Bug fix
• New feature
• Refactoring (no behavior change)
• Dependency update
• Documentation
• Other (describe):

Test plan

• Unit tests (task test)

• E2E tests (task test-e2e)

• Linting (task lint-fix)

• Manual testing (describe below)

• Checked every shell variable in every step resolves. Collected each step's available names — workflow env:, job env:, step env:, locally assigned, and GitHub-provided — and compared against every $VAR referenced. Nothing undefined.

• Confirmed no run: block contains an expression any more, by walking the block structure rather than grepping for a pattern.

• Confirmed how each workflow authenticates, as tabled above, rather than assuming the credential was unused.

• All workflows parse as YAML; actionlint reports 12 findings before and after, all pre-existing.

• zizmor across .github/: no findings to report.

None of this can be verified before merge. All three workflows run only on release events. create-release-tag.yml failing would stop the run after the release pull request merges but before the tag exists, so nothing would be half-published; recovery is re-running it or tagging by hand.

Does this introduce a user-facing change?

No.

Special notes for reviewers

• Best merged just after a release rather than just before.
• With this and Make the zizmor check blocking #6274, the gate could drop from medium to low or lower, since there is nothing left for it to catch. Worth doing as a follow-up once a release has passed through these workflows unchanged — tightening the threshold before the first real exercise would mean two untested changes at once.

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.75%. Comparing base (3993308) to head (f806ff4).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6281      +/-   ##
==========================================
+ Coverage   72.73%   72.75%   +0.02%     
==========================================
  Files         742      742              
  Lines       77325    77325              
==========================================
+ Hits        56244    56261      +17     
+ Misses      17116    17083      -33     
- Partials     3965     3981      +16     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.