chore: workflow hardening — pinact + zizmor [automated]

[infra-hardening]

Automated workflow hardening

This PR was generated by the pt-infra-hardening pipeline.

Changes

.github/workflows/docker-image.yml — zizmor

• Added persist-credentials: false to the actions/checkout step to prevent credential persistence through GitHub Actions artifacts (fixes artipacked)

⚠️ Needs human attention

These findings could not be fixed automatically and need a maintainer's decision:

• .github/workflows/frogbot.yml:3 — dangerous-triggers: pull_request_target is a fundamentally insecure trigger that grants write permissions to workflows running against untrusted forks — requires a human to evaluate whether this is safe or to restructure the workflow. → https://docs.zizmor.sh/audits/#dangerous-triggers

  Once reviewed and accepted, prevent future runs from re-flagging this by adding an inline suppression comment on the offending line in .github/workflows/frogbot.yml:

  # zizmor: ignore[dangerous-triggers] <your reason here>

  Replace <rule-name> with the rule id without the zizmor/ prefix (e.g. secrets-inherit).

---

Suppressing findings

To prevent a finding from being flagged in future hardening runs — whether it was fixed automatically or flagged for manual review — add an inline comment on the relevant line:

# zizmor: ignore[<rule-name>] <your reason here>

Replace <rule-name> with the audit name (e.g. artipacked, secrets-inherit). See zizmor audit docs for all rule names.