Apply some workflow fixes generated by zizmor. (#7418)

See https://github.com/zizmorcore/zizmor

.github/workflows/check_dependent_pr.yaml

@@ -34,6 +34,8 @@ jobs:
       # This is safe as it avoids running untrusted code from the PR branch.
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

.github/workflows/clangd_tidy.yaml

@@ -58,6 +58,8 @@ jobs:
             www.googleapis.com:443
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - id: filter
         uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2

.github/workflows/gh_pages_ci.yaml

@@ -28,6 +28,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0

.github/workflows/gh_pages_deploy.yaml

@@ -33,6 +33,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
@@ -54,11 +56,12 @@ jobs:
       - name: Build with Jekyll
         env:
           JEKYLL_ENV: production
+          STEPS_PAGES_OUTPUTS_BASE_PATH: ${{ steps.pages.outputs.base_path }}
         run: |
           bundle exec jekyll build --verbose \
             --source ./ \
             --destination ./_site \
-            --baseurl "${{ steps.pages.outputs.base_path }}"
+            --baseurl "${STEPS_PAGES_OUTPUTS_BASE_PATH}"
       - name: Upload artifact
         # Automatically uploads an artifact from the './_site' directory by
         # default.

.github/workflows/nightly_release.yaml

@@ -69,6 +69,8 @@ jobs:
 
       - name: Checkout branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up remote cache access
         env:
@@ -92,7 +94,7 @@ jobs:
           ./scripts/run_bazel.py \
             --attempts=5 --jobs-on-last-attempt=4 \
             test -c opt --stamp --remote_download_toplevel \
-            --pre_release=nightly --nightly_date=${{ env.nightly_date }} \
+            --pre_release=nightly --nightly_date=${nightly_date} \
             //toolchain \
             //toolchain/install:carbon_toolchain_tar_gz \
             //toolchain/install:carbon_toolchain_tar_gz_test
@@ -113,8 +115,8 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh release create \
-            --title "Nightly build ${{ env.nightly_date }}" \
+            --title "Nightly build ${nightly_date}" \
             --generate-notes \
             --prerelease \
-            v${{ env.release_version }} \
-            "bazel-bin/toolchain/install/carbon_toolchain-${{ env.release_version }}.tar.gz"
+            v${release_version} \
+            "bazel-bin/toolchain/install/carbon_toolchain-${release_version}.tar.gz"

.github/workflows/prek.yaml

@@ -50,6 +50,8 @@ jobs:
             www.googleapis.com:443
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       # Ensure LLVM is set up consistently.
       - uses: ./.github/actions/build-setup-common

.github/workflows/prek_suggestions.yaml

@@ -48,6 +48,8 @@ jobs:
           reviewdog_version: latest
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Download prek output
         uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0

.github/workflows/sync_repos.yaml

@@ -32,6 +32,8 @@ jobs:
       # Checkout our main repository.
       - name: Checkout the main repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       # Run the sync script.
       - name: Sync to other repositories

.github/workflows/tests.yaml

@@ -81,6 +81,8 @@ jobs:
             www.googleapis.com:443
 
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - id: test-setup
         uses: ./.github/actions/test-setup