more fixes

Author: anthony-nhs

.github/workflows/quality-checks-devcontainer.yml

@@ -317,10 +317,12 @@ jobs:
       - name: Show docker vulnerability output
         if: always()
         run: |
-          echo "Scan output for ${{ matrix.docker_image }}"
+          echo "Scan output for ${DOCKER_IMAGE}"
           if [ -f .trivy_out/dependency_results_docker.txt ]; then
             cat .trivy_out/dependency_results_docker.txt
           fi
+        env:
+          DOCKER_IMAGE: ${{ matrix.docker_image }}
 
   IaC-validation:
     runs-on: ubuntu-22.04

.github/workflows/release.yml

@@ -28,4 +28,3 @@ jobs:
       pinned_image: ${{ needs.get_config_values.outputs.pinned_image }}
       branch_name: main
       tag_format: ${{ needs.get_config_values.outputs.tag_format }}
-    secrets: inherit

.github/workflows/tag-release-devcontainer.yml

@@ -114,6 +114,7 @@ jobs:
               with:
                   repository: ${{ github.repository }}
                   ref: ${{ github.sha }}
+                  persist-credentials: true # needed for semantic-release to push tags and commits
 
             - name: Checkout semantic-release workflow
               uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
@@ -279,6 +280,7 @@ jobs:
                   repository: ${{ github.repository }}
                   ref: gh-pages
                   path: gh-pages
+                  persist-credentials: true # needed for push to gh-pages
 
             - name: Publish release notes to gh-pages
               if: ${{ !inputs.dry_run }}
@@ -319,5 +321,7 @@ jobs:
               shell: bash
               run: |
                   TIMESTAMP=$(date +%s)
-                  VERSION=$(echo ${{ steps.output_version_tag.outputs.VERSION_TAG }} | tr . -)
+                  VERSION=$(echo "${VERSION_TAG}" | tr . -)
                   echo CHANGE_SET_VERSION="$VERSION-$TIMESTAMP" >> "$GITHUB_OUTPUT"
+              env:
+                  VERSION_TAG: ${{ steps.output_version_tag.outputs.VERSION_TAG }}

.github/workflows/update-dev-container-version.yml

@@ -23,6 +23,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Load config value
         id: load-config
         run: |
@@ -98,9 +99,6 @@ jobs:
         run: |
           set -euo pipefail
 
-
-          TARGET_VERSION='${{ steps.resolve-version.outputs.latest_version }}'
-
           if [[ "$TARGET_VERSION" == "$DEVCONTAINER_VERSION" ]]; then
             echo "IMAGE_VERSION is already up to date (${DEVCONTAINER_VERSION})"
             exit 0
@@ -118,16 +116,16 @@ jobs:
 
           config = json.loads(config_file.read_text())
 
-          config['build']['args']['IMAGE_VERSION'] = '${{
-          steps.resolve-version.outputs.latest_version }}'
+          config['build']['args']['IMAGE_VERSION'] = '${TARGET_VERSION}'
 
           config_file.write_text(json.dumps(config, indent=2) + '\n')
 
           PY
 
 
-          echo "Updated IMAGE_VERSION from ${DEVCONTAINER_VERSION} to
-          ${LATEST_DEVCONTAINER_VERSION}"
+          echo "Updated IMAGE_VERSION from ${DEVCONTAINER_VERSION} to ${TARGET_VERSION}"
+        env:
+          TARGET_VERSION: "${{ steps.resolve-version.outputs.latest_version }}"
       - name: Create GitHub App Token
         uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859
         id: generate-token

zizmor.yml

@@ -17,10 +17,17 @@ rules:
       - quality-checks-devcontainer.yml:190:29
       - dependabot-auto-approve-and-merge.yml:24:31
       - dependabot-auto-approve-and-merge.yml:25:36
+      - tag-release-devcontainer.yml:229:34
+      - tag-release-devcontainer.yml:235:35
+      - tag-release-devcontainer.yml:241:34
+      - tag-release-devcontainer.yml:249:35
+      - update-dev-container-version.yml:136:24
+      - update-dev-container-version.yml:137:29
   unpinned-images:
     ignore:
       - quality-checks-devcontainer.yml:32:7
       - quality-checks-devcontainer.yml:215:7
       - quality-checks-devcontainer.yml:285:7
       - quality-checks-devcontainer.yml:328:7
       - tag-release-devcontainer.yml:89:13
+      - quality-checks-devcontainer.yml:330:7