Fix workflow typos and unify file extensions

.github/workflows/cloud-init-image-for-cuttlefish.yaml

@@ -5,7 +5,7 @@ on:
     paths:
       - 'cloud-init-image-for-cuttlefish/**'
   push:
-    branchs:
+    branches:
       - '**'
 
 permissions:
@@ -21,7 +21,7 @@ jobs:
         working-directory: ./cloud-init-image-for-cuttlefish
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Setting up build environment
       run: |
         apt-get update
@@ -37,7 +37,7 @@ jobs:
       run: |
         ./gen_cidata_iso.sh
     - name: Upload artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: cloud-init-image-for-cuttlefish-artifacts
         path: cloud-init-image-for-cuttlefish/gigabyte-cidata.iso
@@ -54,9 +54,9 @@ jobs:
       TEST_DISK_SIZE: "10G"
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: cloud-init-image-for-cuttlefish-artifacts
     - name: Prepare test environment

.github/workflows/gemini-dispatch.yml → .github/workflows/gemini-dispatch.yaml

@@ -111,7 +111,7 @@ jobs:
     needs: 'dispatch'
     if: |-
       ${{ needs.dispatch.outputs.command == 'review' }}
-    uses: './.github/workflows/gemini-review.yml'
+    uses: './.github/workflows/gemini-review.yaml' # zizmor: ignore[secrets-inherit]
     permissions:
       contents: 'read'
       id-token: 'write'
@@ -124,7 +124,7 @@ jobs:
     needs: 'dispatch'
     if: |-
       ${{ needs.dispatch.outputs.command == 'invoke' }}
-    uses: './.github/workflows/gemini-invoke.yml'
+    uses: './.github/workflows/gemini-invoke.yaml' # zizmor: ignore[secrets-inherit]
     permissions:
       contents: 'read'
       id-token: 'write'
@@ -137,7 +137,7 @@ jobs:
     needs: 'dispatch'
     if: |-
       ${{ needs.dispatch.outputs.command == 'approve' }}
-    uses: './.github/workflows/gemini-plan-execute.yml'
+    uses: './.github/workflows/gemini-plan-execute.yaml' # zizmor: ignore[secrets-inherit]
     permissions:
       contents: 'write'
       id-token: 'write'

.github/workflows/gemini-invoke.yml → .github/workflows/gemini-invoke.yaml

@@ -36,11 +36,11 @@ jobs:
           permission-pull-requests: 'write'
 
       - name: 'Checkout Code'
-        uses: 'actions/checkout@v4' # ratchet:exclude
+        uses: 'actions/checkout@11d5960a326750d5838078e36cf38b85af677262' # v4
 
       - name: 'Run Gemini CLI'
         id: 'run_gemini'
-        uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude
+        uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0
         env:
           TITLE: '${{ github.event.pull_request.title }}'
           DESCRIPTION: '${{ github.event.pull_request.body }}'

.github/workflows/gemini-plan-execute.yml → .github/workflows/gemini-plan-execute.yaml

@@ -38,11 +38,11 @@ jobs:
           permission-pull-requests: 'write'
 
       - name: 'Checkout Code'
-        uses: 'actions/checkout@v4' # ratchet:exclude
+        uses: 'actions/checkout@11d5960a326750d5838078e36cf38b85af677262' # v4
 
       - name: 'Run Gemini CLI'
         id: 'run_gemini'
-        uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude
+        uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0
         env:
           TITLE: '${{ github.event.pull_request.title }}'
           DESCRIPTION: '${{ github.event.pull_request.body }}'

.github/workflows/gemini-review.yml → .github/workflows/gemini-review.yaml

@@ -40,7 +40,7 @@ jobs:
         uses: 'actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8' # ratchet:actions/checkout@v6
 
       - name: 'Run Gemini pull request review'
-        uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude
+        uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0
         id: 'gemini_pr_review'
         env:
           GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'
@@ -113,7 +113,7 @@ jobs:
             ]
           prompt: '/pr-code-review'
       - name: 'Run Gemini security analysis review'
-        uses: 'google-github-actions/run-gemini-cli@v0' # ratchet:exclude
+        uses: 'google-github-actions/run-gemini-cli@f77273f4c914e4bf38440cf36a0369cb64a37489' # v0
         id: 'gemini_security_analysis'
         env:
           GITHUB_TOKEN: '${{ steps.mint_identity_token.outputs.token || secrets.GITHUB_TOKEN || github.token }}'

.github/workflows/gigabyte-ampere-cloud-installer.yaml

@@ -5,9 +5,12 @@ on:
     paths:
       - 'gigabyte-ampere-cloud-installer/**'
   push:
-    branchs:
+    branches:
       - '**'
 
+permissions:
+  contents: read
+
 jobs:
   build-cloud-installer-initramfs-job:
     runs-on: ubuntu-22.04-arm
@@ -19,7 +22,7 @@ jobs:
         working-directory: ./gigabyte-ampere-cloud-installer
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Setting up build environment
       run: |
         apt-get update
@@ -39,7 +42,7 @@ jobs:
         export HOME=$GITHUB_WORKSPACE
         ./regenerate-initramfs.sh
     - name: Upload artifacts for initramfs
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: gigabyte-ampere-cloud-installer-initramfs-artifacts
         path: gigabyte-ampere-cloud-installer/initrd.img-*
@@ -55,9 +58,9 @@ jobs:
         working-directory: ./gigabyte-ampere-cloud-installer
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-initramfs-artifacts
         path: ./gigabyte-ampere-cloud-installer
@@ -91,7 +94,7 @@ jobs:
     - name: Clean build directory
       run: ./lb_clean.sh
     - name: Upload artifacts
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: gigabyte-ampere-cloud-installer-artifacts
         path: gigabyte-ampere-cloud-installer/live-image-arm64.iso.xz
@@ -103,7 +106,7 @@ jobs:
       contents: read
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Use github CLI to search for run-id
       id: search-run
       env:
@@ -113,13 +116,13 @@ jobs:
         echo "Found Run ID is : ${RUN_ID}"
         echo "target_id=$RUN_ID" >> $GITHUB_OUTPUT
     - name: Download artifact
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: cloud-init-image-for-cuttlefish-artifacts
         run-id: ${{ steps.search-run.outputs.target_id }}
         github-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Reupload artifact for later test cases
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: gigabyte-ampere-cloud-installer-cidata
         path: gigabyte-cidata.iso
@@ -138,14 +141,14 @@ jobs:
       TEST_DISK_SIZE: "10G"
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download installer artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-artifacts
         path: ./gigabyte-ampere-cloud-installer
     - name: Download cidata artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-cidata
         path: ./gigabyte-ampere-cloud-installer
@@ -194,14 +197,14 @@ jobs:
       TEST_DISK_SIZE: "10G"
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download installer artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-artifacts
         path: ./gigabyte-ampere-cloud-installer
     - name: Download cidata artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-cidata
         path: ./gigabyte-ampere-cloud-installer
@@ -252,14 +255,14 @@ jobs:
       TEST_DISK_SIZE: "10G"
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download installer artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-artifacts
         path: ./gigabyte-ampere-cloud-installer
     - name: Download cidata artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-cidata
         path: ./gigabyte-ampere-cloud-installer
@@ -310,14 +313,14 @@ jobs:
       TEST_DISK_SIZE: "10G"
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download installer artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-artifacts
         path: ./gigabyte-ampere-cloud-installer
     - name: Download cidata artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-cidata
         path: ./gigabyte-ampere-cloud-installer
@@ -370,14 +373,14 @@ jobs:
       TEST_DISK_SIZE: "10G"
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download installer artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-artifacts
         path: ./gigabyte-ampere-cloud-installer
     - name: Download cidata artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-cidata
         path: ./gigabyte-ampere-cloud-installer
@@ -445,14 +448,14 @@ jobs:
         working-directory: ./gigabyte-ampere-cloud-installer
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
     - name: Download installer artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-artifacts
         path: ./gigabyte-ampere-cloud-installer
     - name: Download cidata artifacts
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
       with:
         name: gigabyte-ampere-cloud-installer-cidata
         path: ./gigabyte-ampere-cloud-installer

.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml

@@ -6,7 +6,7 @@ on:
       - '.github/workflows/gigabyte-ampere-cuttlefish-installer.yaml'
       - 'gigabyte-ampere-cuttlefish-installer/**'
   push:
-    branchs:
+    branches:
       - '**'
 
 permissions: