From 79763d9169e21acd0074adbcf0c7b4c63b9e506f Mon Sep 17 00:00:00 2001
From: Venkaiah Babu Neelam <venkaiahbabu@google.com>
Date: Thu, 6 Aug 2026 19:24:57 +0530
Subject: [PATCH 1/2] fix: address zizmor security audit findings with auto-fix
 in GitHub workflows

---
 .github/workflows/block_major_releases.yml     | 2 +-
 .github/workflows/google-contributor-stale.yml | 2 +-
 .github/workflows/import.yml                   | 8 +++++---
 .github/workflows/mypy.yml                     | 8 +++++---
 .github/workflows/stale.yml                    | 2 +-
 5 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/block_major_releases.yml b/.github/workflows/block_major_releases.yml
index 3f69bcff5..59696502c 100644
--- a/.github/workflows/block_major_releases.yml
+++ b/.github/workflows/block_major_releases.yml
@@ -15,7 +15,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Enforce Multiple Approvals for Major Releases
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const prTitle = context.payload.pull_request.title;
diff --git a/.github/workflows/google-contributor-stale.yml b/.github/workflows/google-contributor-stale.yml
index ebff9cfcd..d4c14677d 100644
--- a/.github/workflows/google-contributor-stale.yml
+++ b/.github/workflows/google-contributor-stale.yml
@@ -14,7 +14,7 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           any-of-labels: "google-contributor"
diff --git a/.github/workflows/import.yml b/.github/workflows/import.yml
index 8a110616b..131d7523f 100644
--- a/.github/workflows/import.yml
+++ b/.github/workflows/import.yml
@@ -17,10 +17,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -33,4 +35,4 @@ jobs:
 
       - name: Run import test
         run: |
-          pytest google/genai/tests/imports/test_no_optional_imports.py
\ No newline at end of file
+          pytest google/genai/tests/imports/test_no_optional_imports.py
diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml
index b189419de..1189099f9 100644
--- a/.github/workflows/mypy.yml
+++ b/.github/workflows/mypy.yml
@@ -18,10 +18,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -33,4 +35,4 @@ jobs:
           pip install -r requirements.txt
 
       - name: Run mypy  ${{ matrix.python-version }}
-        run: mypy google/genai/
\ No newline at end of file
+        run: mypy google/genai/
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index dff9b18fc..876c52c74 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -16,7 +16,7 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/stale@v10
+    - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         days-before-issue-stale: 7

From f1727b9b1fda9bb0d8aa445b8aace64f6fe229ad Mon Sep 17 00:00:00 2001
From: Venkaiah Babu Neelam <venkaiahbabu@google.com>
Date: Fri, 7 Aug 2026 13:51:23 +0530
Subject: [PATCH 2/2] fix: manual fix for zizmor

---
 .github/workflows/import.yml | 2 ++
 .github/workflows/mypy.yml   | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/import.yml b/.github/workflows/import.yml
index 131d7523f..8678cdbf2 100644
--- a/.github/workflows/import.yml
+++ b/.github/workflows/import.yml
@@ -6,6 +6,8 @@ on:
     branches: [ main ]
   pull_request:
     branches: [ main ]
+permissions:
+  contents: read
 
 jobs:
   test-import:
diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml
index 1189099f9..5a8041e64 100644
--- a/.github/workflows/mypy.yml
+++ b/.github/workflows/mypy.yml
@@ -8,6 +8,8 @@ on:
   pull_request:
     branches:
       - main
+permissions:
+  contents: read
 
 jobs:
   mypy: