Vouch request: enbiyagoral

[enbiyagoral]

What do you want to work on?

I ran zizmor locally using the same settings as workflow-security.yml and found 29 high severity findings. I’d like to fix 12 of them across 7 workflow files, mostly template injection and excessive permissions. I’m leaving the unpinned-images findings out for now since pinning ci:latest to a digest feels like something the maintainers should decide

Why this change?

The goal is to reduce the high severity CI findings without changing the intended workflow behavior. After the changes, zizmor goes from 29 to 17 high findings and actionlint passes.

Checklist

• I wrote this request myself (not AI-generated)
• I have read CONTRIBUTING.md