Initial workflows static analysis fixes

[derrickaw]

1. Static analysis on workflows
2. zizmor --fix=all --gh-token=$(gh auth token) .github/workflows/
3. Added an ignore rule for commit sha.
4. Other findings will need to be investigated more in another PR.
5. First part of [Task]: Remove Zizmor workflow vulnerability findings #39105

---

Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily:

• Mention the appropriate issue in your description (for example: addresses #123), if applicable. This will automatically add a link to the pull request in the issue. If you would like the issue to automatically close on merging the pull request, comment fixes #<ISSUE NUMBER> instead.
• Update CHANGES.md with noteworthy changes.
• If this contribution is large, please file an Apache Individual Contributor License Agreement.

See the Contributor Guide for more tips on how to make review process smoother.

To check the build health, please visit https://github.com/apache/beam/blob/master/.test-infra/BUILD_STATUS.md

GitHub Actions Tests Status (on master branch)

See CI.md for more information about GitHub Actions CI or the workflows README to see a list of phrases to trigger workflows.

[gemini-code-assist]

Note

Gemini is unable to generate a summary for this pull request due to the file types involved not being currently supported.

[derrickaw]

assign set of reviewers

[github-actions]

Assigning reviewers:

R: @Abacn for label build.

Note: If you would like to opt out of this review, comment assign to next reviewer.

Available commands:

• stop reviewer notifications - opt out of the automated review tooling
• remind me after tests pass - tag the comment author after tests pass
• waiting on author - shift the attention set back to the author (any comment or push by the author will return the attention set to the reviewers)

The PR bot will only process comments in the main thread (not review comments).

[derrickaw]

PreCommit Java Dataflow Non-portable workflow looks permared before this PR.

[derrickaw]

Hi @Abacn, does this look ok? I think this should be a no-op. Further findings through zizmor will have to take a more careful approach. Thanks

[Abacn]

ack. LGTM

[Abacn]

Note that there should be a PreCommit GHA triggered, but currently failing with

PreCommit GHA currently failing due to The action zizmorcore/zizmor-action@6599ee8 is not allowed in apache/beam

[derrickaw]

Note that there should be a PreCommit GHA triggered, but currently failing with

PreCommit GHA currently failing due to The action zizmorcore/zizmor-action@6599ee8 is not allowed in apache/beam

Fixed the PreCommit GHA workflow and its running again for this PR. Thanks