From 6e066da3d2fe6e8cc62ad24517de136e439f1a2f Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:13 -0700
Subject: [PATCH 01/17] Add shared zizmor workflow

---
 .github/workflows/zizmor.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000000..61d7b7e5153
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,18 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '43 18 * * 5'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  zizmor:
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1
\ No newline at end of file

From 52f5cccb89cdecc556a69f9ef83bc9523b979eeb Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:13 -0700
Subject: [PATCH 02/17] Fix blocking zizmor findings

---
 .github/workflows/backport.yml               | 1 +
 .github/workflows/build.yml                  | 3 ++-
 .github/workflows/codeql.yml                 | 3 ++-
 .github/workflows/detect-api-changes.yml     | 9 +++++----
 .github/workflows/prepare-patch-release.yml  | 1 +
 .github/workflows/prepare-release-branch.yml | 2 ++
 .github/workflows/release.yml                | 1 +
 7 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index be5fed5650c..5b92dcaffd8 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -34,6 +34,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request
         env:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8cdf11b7a99..4d68eed89fd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -56,7 +56,8 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      - name: Set up gradle
+      # This tests release branches but does not publish release artifacts.
+      - name: Set up gradle # zizmor: ignore[cache-poisoning]
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
       - name: Build
         run: >
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1346228c29c..af677005674 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,8 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      - name: Set up gradle
+      # This analyzes release branches but does not build or publish release artifacts.
+      - name: Set up gradle # zizmor: ignore[cache-poisoning]
         if: matrix.language == 'java'
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
 
diff --git a/.github/workflows/detect-api-changes.yml b/.github/workflows/detect-api-changes.yml
index a3fffc04a79..ee84f99fd6b 100644
--- a/.github/workflows/detect-api-changes.yml
+++ b/.github/workflows/detect-api-changes.yml
@@ -4,10 +4,9 @@ on:
   # pull_request_target is used instead of pull_request so that the workflow has write access
   # (to post comments and apply labels) even when triggered by fork PRs.
   #
-  # SECURITY: this workflow must never checkout or execute any code from the PR branch.
-  # Doing so would allow malicious PRs to exfiltrate secrets. All we use from the PR
-  # is github.event.pull_request.number (an integer), which is safe.
-  pull_request_target:
+  # Required to label and comment on fork PRs; no PR code is checked out, and
+  # the PR number and head ref are passed through env and treated only as data.
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, synchronize, reopened, ready_for_review]
 
 permissions: {}
@@ -23,6 +22,8 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-issues: write
+          permission-pull-requests: read
 
       - name: Check for API changes and update PR
         env:
diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml
index 040df74da66..7f3e65ddfa9 100644
--- a/.github/workflows/prepare-patch-release.yml
+++ b/.github/workflows/prepare-patch-release.yml
@@ -52,6 +52,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request
         env:
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index d0af0f2b414..7407b3b05a9 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -68,6 +68,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against the release branch
         env:
@@ -124,6 +125,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against main
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 35d9da2b3af..e945d6c331c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -219,6 +219,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against main
         env:

From 20f35fcf028a146d8311907c69079c8287260acb Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:14 -0700
Subject: [PATCH 03/17] Add shared zizmor workflow

---
 .github/workflows/zizmor.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 61d7b7e5153..59a032ba4e2 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -9,10 +9,11 @@ on:
     - cron: '43 18 * * 5'
   workflow_dispatch:
 
-permissions:
-  contents: read
-  security-events: write
+permissions: {}
 
 jobs:
   zizmor:
+    permissions:
+      contents: read # for actions/checkout
+      security-events: write # for zizmor to upload SARIF results
     uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1
\ No newline at end of file

From 0461d8c13d93e12a3dcce62e2c1a068838547582 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:14 -0700
Subject: [PATCH 04/17] Add trailing newline

---
 .github/workflows/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 59a032ba4e2..45e4436c9bb 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -16,4 +16,4 @@ jobs:
     permissions:
       contents: read # for actions/checkout
       security-events: write # for zizmor to upload SARIF results
-    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1
\ No newline at end of file
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1

From f8c07e414bd1946092088545641f57069bec8bdf Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:14 -0700
Subject: [PATCH 05/17] Clarify CodeQL release branch comment

---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index af677005674..82f07c9e7ac 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,7 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      # This analyzes release branches but does not build or publish release artifacts.
+      # This workflow analyzes release branches but does not build or publish release artifacts.
       - name: Set up gradle # zizmor: ignore[cache-poisoning]
         if: matrix.language == 'java'
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

From 5772ca8c8d4676887dc7f0d1306af510c33a38c6 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:15 -0700
Subject: [PATCH 06/17] Document zizmor schedule

---
 .github/workflows/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 45e4436c9bb..c7f7115d35f 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -6,7 +6,7 @@ on:
   pull_request:
     branches: [main]
   schedule:
-    - cron: '43 18 * * 5'
+    - cron: '43 18 * * 5' # weekly at 18:43 UTC on Friday
   workflow_dispatch:
 
 permissions: {}

From b97200145aeacd506586ff31858284f7cc35d960 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:15 -0700
Subject: [PATCH 07/17] Run zizmor on all pull requests

---
 .github/workflows/zizmor.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index c7f7115d35f..4c9b6cbdc10 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -4,7 +4,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
   schedule:
     - cron: '43 18 * * 5' # weekly at 18:43 UTC on Friday
   workflow_dispatch:

From 4e2d4785770552d3917f5a99cc16125b01056e51 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:16 -0700
Subject: [PATCH 08/17] Scan release branch pushes with zizmor

---
 .github/workflows/zizmor.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 4c9b6cbdc10..4d9118803f4 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -2,7 +2,9 @@ name: Zizmor
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
+      - release/*
   pull_request:
   schedule:
     - cron: '43 18 * * 5' # weekly at 18:43 UTC on Friday

From cd85f491d83cdc0ffe82fef1a21ea8f9a03cec7a Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:16 -0700
Subject: [PATCH 09/17] Update shared zizmor workflow to v0.4.0

---
 .github/workflows/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 4d9118803f4..d97b5797db1 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -17,4 +17,4 @@ jobs:
     permissions:
       contents: read # for actions/checkout
       security-events: write # for zizmor to upload SARIF results
-    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0

From 34e32082277c85f8d784e05116b77cd3d586e46a Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:17 -0700
Subject: [PATCH 10/17] ci: remediate zizmor findings

---
 .github/workflows/backport.yml                           | 1 +
 .github/workflows/benchmark-tags.yml                     | 1 +
 .github/workflows/benchmark.yml                          | 2 ++
 .github/workflows/build-daily.yml                        | 2 ++
 .github/workflows/build-tracecontext-testsuite.yml       | 2 ++
 .github/workflows/build.yml                              | 7 ++++++-
 .github/workflows/codeql.yml                             | 2 ++
 .github/workflows/fossa.yml                              | 2 ++
 .github/workflows/gradle-wrapper-validation.yml          | 2 ++
 .github/workflows/issue-management-feedback-label.yml    | 2 ++
 .github/workflows/javadoc-crawler.yml                    | 2 ++
 .github/workflows/prepare-patch-release.yml              | 2 ++
 .github/workflows/prepare-release-branch.yml             | 8 ++++++++
 .github/workflows/release.yml                            | 9 +++++++++
 .github/workflows/reusable-link-check.yml                | 1 +
 .../workflows/sonatype-guide-dependency-audit-daily.yml  | 2 ++
 16 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 5b92dcaffd8..744c05ff0fc 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -25,6 +25,7 @@ jobs:
         with:
           # history is needed to run git cherry-pick below
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Use CLA approved github bot
         run: .github/scripts/use-cla-approved-bot.sh
diff --git a/.github/workflows/benchmark-tags.yml b/.github/workflows/benchmark-tags.yml
index b9c597584b4..88f5596c0e8 100644
--- a/.github/workflows/benchmark-tags.yml
+++ b/.github/workflows/benchmark-tags.yml
@@ -25,6 +25,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ matrix.tag-version }}
+          persist-credentials: false
 
       - id: setup-java
         name: Set up Java for build
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index d479e73eb9f..9fa7e6aeb0f 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -28,6 +28,8 @@ jobs:
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - id: setup-java
         name: Set up Java for build
diff --git a/.github/workflows/build-daily.yml b/.github/workflows/build-daily.yml
index ce7bcbded10..5a2d8671deb 100644
--- a/.github/workflows/build-daily.yml
+++ b/.github/workflows/build-daily.yml
@@ -20,6 +20,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Java
         uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
diff --git a/.github/workflows/build-tracecontext-testsuite.yml b/.github/workflows/build-tracecontext-testsuite.yml
index 39bd88f3c5e..e8cff209db0 100644
--- a/.github/workflows/build-tracecontext-testsuite.yml
+++ b/.github/workflows/build-tracecontext-testsuite.yml
@@ -21,6 +21,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Login to GitHub package registry
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4d68eed89fd..4d7676d0fb4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -40,6 +40,8 @@ jobs:
             jmh-based-tests: true
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - id: setup-java-test
         name: Set up Java ${{ matrix.test-java-version }} for tests
@@ -64,9 +66,10 @@ jobs:
             ./gradlew build
             ${{ matrix.coverage && 'jacocoTestReport' || '' }}
             -PtestJavaVersion=${{ matrix.test-java-version }}
-            "-Porg.gradle.java.installations.paths=${{ steps.setup-java-test.outputs.path }}"
+            "-Porg.gradle.java.installations.paths=${TEST_JAVA_PATH}"
             "-Porg.gradle.java.installations.auto-download=false"
         env:
+          TEST_JAVA_PATH: ${{ steps.setup-java-test.outputs.path }}
           # JMH-based tests run only if this environment variable is set to true
           RUN_JMH_BASED_TESTS: ${{ matrix.jmh-based-tests }}
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -116,6 +119,8 @@ jobs:
           - 25 # renovate(graal-java-version)
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd # v1.6.3
         with:
           java-version: ${{ matrix.test-graal-version }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 82f07c9e7ac..aeca184f912 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,6 +32,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Java 21
         if: matrix.language == 'java'
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index 4c6a61a31b4..ef87d73cf84 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
         with:
diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
index 62522858c51..6c2dfc7994a 100644
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ b/.github/workflows/gradle-wrapper-validation.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       # this needs to be in its own workflow in order to make OSSF scorecard happy
       - uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
diff --git a/.github/workflows/issue-management-feedback-label.yml b/.github/workflows/issue-management-feedback-label.yml
index 56664b31c25..a9b5b4d845d 100644
--- a/.github/workflows/issue-management-feedback-label.yml
+++ b/.github/workflows/issue-management-feedback-label.yml
@@ -19,6 +19,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Remove labels
         env:
diff --git a/.github/workflows/javadoc-crawler.yml b/.github/workflows/javadoc-crawler.yml
index c8665a122da..4d4f5499cf6 100644
--- a/.github/workflows/javadoc-crawler.yml
+++ b/.github/workflows/javadoc-crawler.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
         with:
diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml
index 7f3e65ddfa9..2cb48c89882 100644
--- a/.github/workflows/prepare-patch-release.yml
+++ b/.github/workflows/prepare-patch-release.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - run: |
           if [[ ! $GITHUB_REF_NAME =~ ^release/v[0-9]+\.[0-9]+\.x$ ]]; then
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index 7407b3b05a9..b7ed25ba620 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Verify prerequisites
         run: |
@@ -35,9 +37,13 @@ jobs:
           # history is needed to allow fast-forward push below in case
           # re-running this workflow after merging additional PRs to main
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Create release branch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          gh auth setup-git
           version=$(.github/scripts/get-version.sh)
           version=${version//-SNAPSHOT/}
           if [[ $version =~ ^([0-9]+)\.([0-9]+)\.0$ ]]; then
@@ -93,6 +99,8 @@ jobs:
       - prereqs
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set environment variables
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e945d6c331c..bdf580d2f72 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,6 +22,8 @@ jobs:
           fi
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
         with:
@@ -71,6 +73,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
+          persist-credentials: false
 
       - name: Check that change log update was merged to main
         run: |
@@ -87,6 +90,7 @@ jobs:
         with:
           # tags are needed for the generate-release-contributors.sh script
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Generate release notes
         env:
@@ -146,6 +150,8 @@ jobs:
       # add change log sync (if any) into this PR since the apidiff update
       # is required before any other PR can be merged anyway
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Copy change log section from release branch
         env:
@@ -157,6 +163,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
+          persist-credentials: false
 
       - name: Merge change log to main
         env:
@@ -219,6 +226,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against main
@@ -227,6 +235,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Post-release updates for $VERSION"
           body="Post-release updates for \`$VERSION\`."
           branch="otelbot/post-release-updates-${VERSION}"
diff --git a/.github/workflows/reusable-link-check.yml b/.github/workflows/reusable-link-check.yml
index 59fc7dcac7b..0af1e753659 100644
--- a/.github/workflows/reusable-link-check.yml
+++ b/.github/workflows/reusable-link-check.yml
@@ -13,6 +13,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0 # needed for merge-base used in modified-files mode
+          persist-credentials: false
 
       - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
 
diff --git a/.github/workflows/sonatype-guide-dependency-audit-daily.yml b/.github/workflows/sonatype-guide-dependency-audit-daily.yml
index a09c000579f..ee3512c0067 100644
--- a/.github/workflows/sonatype-guide-dependency-audit-daily.yml
+++ b/.github/workflows/sonatype-guide-dependency-audit-daily.yml
@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
         with:

From d3bff53f78128baa0dc0757e9cb7450bff72111b Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:01:20 -0700
Subject: [PATCH 11/17] ci: preserve authenticated workflow pushes

---
 .github/workflows/backport.yml               | 2 ++
 .github/workflows/build.yml                  | 1 +
 .github/workflows/prepare-patch-release.yml  | 2 ++
 .github/workflows/prepare-release-branch.yml | 2 ++
 4 files changed, 7 insertions(+)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 744c05ff0fc..9fe6c762e81 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -35,6 +35,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request
@@ -43,6 +44,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
           title=$(gh pr view $NUMBER --json title --jq .title)
 
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4d7676d0fb4..26a8ba90975 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,6 +62,7 @@ jobs:
       - name: Set up gradle # zizmor: ignore[cache-poisoning]
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
       - name: Build
+        shell: bash
         run: >
             ./gradlew build
             ${{ matrix.coverage && 'jacocoTestReport' || '' }}
diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml
index 2cb48c89882..f141fd82b54 100644
--- a/.github/workflows/prepare-patch-release.yml
+++ b/.github/workflows/prepare-patch-release.yml
@@ -54,6 +54,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request
@@ -61,6 +62,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Prepare release $VERSION"
           branch="otelbot/prepare-release-${VERSION}"
 
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index b7ed25ba620..b3253b71395 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -74,6 +74,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against the release branch
@@ -140,6 +141,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Update version to $NEXT_VERSION"
           body="Update version to \`$NEXT_VERSION\`."
           branch="otelbot/update-version-to-${NEXT_VERSION}"

From c3326f0aacc5fb9960429d84a06b9cf57922793d Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:27:06 -0700
Subject: [PATCH 12/17] ci: authenticate release pull request push

---
 .github/workflows/prepare-release-branch.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index b3253b71395..432622ad67b 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -82,6 +82,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Prepare release $VERSION"
           branch="otelbot/prepare-release-${VERSION}"
 

From 73917f14588a227bffcfcf934435441f2350a0b1 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:48:38 -0700
Subject: [PATCH 13/17] ci: preserve workflow push credentials

---
 .github/workflows/backport.yml               | 17 ++++++-------
 .github/workflows/prepare-patch-release.yml  | 13 +++++-----
 .github/workflows/prepare-release-branch.yml | 25 +++++++++++---------
 .github/workflows/release.yml                | 13 +++++-----
 4 files changed, 37 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 9fe6c762e81..c076bda0c7b 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -35,24 +35,25 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
-          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request
         env:
           NUMBER: ${{ github.event.inputs.number }}
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
-          commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
-          title=$(gh pr view $NUMBER --json title --jq .title)
+          commit=$(GH_TOKEN="$OTELBOT_TOKEN" gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
+          title=$(GH_TOKEN="$OTELBOT_TOKEN" gh pr view $NUMBER --json title --jq .title)
 
           branch="otelbot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}"
 
           git checkout -b $branch
           git cherry-pick $commit
           git push --set-upstream origin $branch
-          gh pr create --title "[$GITHUB_REF_NAME] $title" \
-                       --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
-                       --base $GITHUB_REF_NAME
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "[$GITHUB_REF_NAME] $title" \
+            --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
+            --base $GITHUB_REF_NAME
diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml
index f141fd82b54..12a48e74689 100644
--- a/.github/workflows/prepare-patch-release.yml
+++ b/.github/workflows/prepare-patch-release.yml
@@ -54,13 +54,13 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
-          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
           message="Prepare release $VERSION"
@@ -69,6 +69,7 @@ jobs:
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "[$GITHUB_REF_NAME] $message" \
-                       --body "$message." \
-                       --base $GITHUB_REF_NAME
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "[$GITHUB_REF_NAME] $message" \
+            --body "$message." \
+            --base $GITHUB_REF_NAME
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index 432622ad67b..b89b36a8fd1 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -74,13 +74,13 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
-          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against the release branch
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
           message="Prepare release $VERSION"
@@ -89,9 +89,10 @@ jobs:
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
-                       --body "$message." \
-                       --base $RELEASE_BRANCH_NAME
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "[$RELEASE_BRANCH_NAME] $message" \
+            --body "$message." \
+            --base $RELEASE_BRANCH_NAME
 
   create-pull-request-against-main:
     permissions:
@@ -139,8 +140,9 @@ jobs:
 
       - name: Create pull request against main
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
           message="Update version to $NEXT_VERSION"
@@ -150,6 +152,7 @@ jobs:
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "$message" \
-                       --body "$body" \
-                       --base main
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "$message" \
+            --body "$body" \
+            --base main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bdf580d2f72..7231a54779c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -226,14 +226,14 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
-          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against main
         env:
           VERSION: ${{ needs.release.outputs.version }}
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
           message="Post-release updates for $VERSION"
@@ -243,6 +243,7 @@ jobs:
           git checkout -b $branch
           git commit -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "$message" \
-                       --body "$body" \
-                       --base main
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "$message" \
+            --body "$body" \
+            --base main

From aa82a7396fcd1f4b1e12cd6dacc19f64112f5e4a Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 08:03:59 -0700
Subject: [PATCH 14/17] ci: use checkout credentials for git pushes

---
 .github/workflows/backport.yml               | 13 ++++++------
 .github/workflows/prepare-patch-release.yml  |  9 ++++-----
 .github/workflows/prepare-release-branch.yml | 21 ++++++++------------
 .github/workflows/release.yml                |  9 ++++-----
 4 files changed, 22 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index c076bda0c7b..d90b21d90e8 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -25,7 +25,8 @@ jobs:
         with:
           # history is needed to run git cherry-pick below
           fetch-depth: 0
-          persist-credentials: false
+          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
+          persist-credentials: true
 
       - name: Use CLA approved github bot
         run: .github/scripts/use-cla-approved-bot.sh
@@ -40,20 +41,18 @@ jobs:
       - name: Create pull request
         env:
           NUMBER: ${{ github.event.inputs.number }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # pull requests from secrets.GITHUB_TOKEN do not run workflows
-          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
-          gh auth setup-git
-          commit=$(GH_TOKEN="$OTELBOT_TOKEN" gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
-          title=$(GH_TOKEN="$OTELBOT_TOKEN" gh pr view $NUMBER --json title --jq .title)
+          commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
+          title=$(gh pr view $NUMBER --json title --jq .title)
 
           branch="otelbot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}"
 
           git checkout -b $branch
           git cherry-pick $commit
           git push --set-upstream origin $branch
-          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+          gh pr create \
             --title "[$GITHUB_REF_NAME] $title" \
             --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
             --base $GITHUB_REF_NAME
diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml
index 12a48e74689..779053f0ddb 100644
--- a/.github/workflows/prepare-patch-release.yml
+++ b/.github/workflows/prepare-patch-release.yml
@@ -13,7 +13,8 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          persist-credentials: false
+          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
+          persist-credentials: true
 
       - run: |
           if [[ ! $GITHUB_REF_NAME =~ ^release/v[0-9]+\.[0-9]+\.x$ ]]; then
@@ -58,18 +59,16 @@ jobs:
 
       - name: Create pull request
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # pull requests from secrets.GITHUB_TOKEN do not run workflows
-          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
-          gh auth setup-git
           message="Prepare release $VERSION"
           branch="otelbot/prepare-release-${VERSION}"
 
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+          gh pr create \
             --title "[$GITHUB_REF_NAME] $message" \
             --body "$message." \
             --base $GITHUB_REF_NAME
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index b89b36a8fd1..3a14c26e93e 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -37,13 +37,11 @@ jobs:
           # history is needed to allow fast-forward push below in case
           # re-running this workflow after merging additional PRs to main
           fetch-depth: 0
-          persist-credentials: false
+          # zizmor: ignore[artipacked] Credentials are required by the branch pushes below.
+          persist-credentials: true
 
       - name: Create release branch
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh auth setup-git
           version=$(.github/scripts/get-version.sh)
           version=${version//-SNAPSHOT/}
           if [[ $version =~ ^([0-9]+)\.([0-9]+)\.0$ ]]; then
@@ -78,18 +76,16 @@ jobs:
 
       - name: Create pull request against the release branch
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # pull requests from secrets.GITHUB_TOKEN do not run workflows
-          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
-          gh auth setup-git
           message="Prepare release $VERSION"
           branch="otelbot/prepare-release-${VERSION}"
 
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+          gh pr create \
             --title "[$RELEASE_BRANCH_NAME] $message" \
             --body "$message." \
             --base $RELEASE_BRANCH_NAME
@@ -103,7 +99,8 @@ jobs:
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          persist-credentials: false
+          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
+          persist-credentials: true
 
       - name: Set environment variables
         run: |
@@ -140,11 +137,9 @@ jobs:
 
       - name: Create pull request against main
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # pull requests from secrets.GITHUB_TOKEN do not run workflows
-          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
-          gh auth setup-git
           message="Update version to $NEXT_VERSION"
           body="Update version to \`$NEXT_VERSION\`."
           branch="otelbot/update-version-to-${NEXT_VERSION}"
@@ -152,7 +147,7 @@ jobs:
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+          gh pr create \
             --title "$message" \
             --body "$body" \
             --base main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7231a54779c..a77ec84cf59 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -73,7 +73,8 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
-          persist-credentials: false
+          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
+          persist-credentials: true
 
       - name: Check that change log update was merged to main
         run: |
@@ -231,11 +232,9 @@ jobs:
       - name: Create pull request against main
         env:
           VERSION: ${{ needs.release.outputs.version }}
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # pull requests from secrets.GITHUB_TOKEN do not run workflows
-          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
-          gh auth setup-git
           message="Post-release updates for $VERSION"
           body="Post-release updates for \`$VERSION\`."
           branch="otelbot/post-release-updates-${VERSION}"
@@ -243,7 +242,7 @@ jobs:
           git checkout -b $branch
           git commit -m "$message"
           git push --set-upstream origin $branch
-          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+          gh pr create \
             --title "$message" \
             --body "$body" \
             --base main

From 4d35a3b65aaf8c32400c77091b0b5018acbc1537 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 08:32:19 -0700
Subject: [PATCH 15/17] ci: retain credentials on pushed checkout

---
 .github/workflows/release.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a77ec84cf59..47f979b4e81 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -73,8 +73,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
-          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
-          persist-credentials: true
+          persist-credentials: false
 
       - name: Check that change log update was merged to main
         run: |
@@ -164,7 +163,8 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
-          persist-credentials: false
+          # zizmor: ignore[artipacked] Credentials are required by the branch push below.
+          persist-credentials: true
 
       - name: Merge change log to main
         env:

From b1c1585c915cf5b1c89d20e4a9b520240dbedf21 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 10:28:05 -0700
Subject: [PATCH 16/17] ci: clarify zizmor suppression rationales

---
 .github/workflows/build.yml              | 2 +-
 .github/workflows/codeql.yml             | 2 +-
 .github/workflows/detect-api-changes.yml | 3 ++-
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 26a8ba90975..4c8e365ebfd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,7 +58,7 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      # This tests release branches but does not publish release artifacts.
+      # zizmor cache-poisoning suppression rationale: this tests release branches but does not publish release artifacts.
       - name: Set up gradle # zizmor: ignore[cache-poisoning]
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
       - name: Build
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index aeca184f912..902fb0823c0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -42,7 +42,7 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      # This workflow analyzes release branches but does not build or publish release artifacts.
+      # zizmor cache-poisoning suppression rationale: this workflow analyzes release branches but does not build or publish release artifacts.
       - name: Set up gradle # zizmor: ignore[cache-poisoning]
         if: matrix.language == 'java'
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
diff --git a/.github/workflows/detect-api-changes.yml b/.github/workflows/detect-api-changes.yml
index ee84f99fd6b..05fbea37e64 100644
--- a/.github/workflows/detect-api-changes.yml
+++ b/.github/workflows/detect-api-changes.yml
@@ -4,7 +4,8 @@ on:
   # pull_request_target is used instead of pull_request so that the workflow has write access
   # (to post comments and apply labels) even when triggered by fork PRs.
   #
-  # Required to label and comment on fork PRs; no PR code is checked out, and
+  # zizmor dangerous-triggers suppression rationale: required to label and comment on fork PRs;
+  # no PR code is checked out, and
   # the PR number and head ref are passed through env and treated only as data.
   pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, synchronize, reopened, ready_for_review]

From d6729de2a6d1d166005c54d3949662891d7923c4 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Wed, 22 Jul 2026 10:40:49 -0700
Subject: [PATCH 17/17] ci: colocate zizmor suppression rationales

---
 .github/workflows/build.yml               | 5 +++--
 .github/workflows/codeql.yml              | 5 +++--
 .github/workflows/detect-api-changes.yml  | 8 ++++----
 .github/workflows/survey-on-merged-pr.yml | 4 +++-
 4 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4c8e365ebfd..0c07bfd7d36 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,8 +58,9 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      # zizmor cache-poisoning suppression rationale: this tests release branches but does not publish release artifacts.
-      - name: Set up gradle # zizmor: ignore[cache-poisoning]
+      - name: Set up gradle
+        # zizmor: ignore[cache-poisoning] This tests release branches but does not
+        # publish release artifacts.
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
       - name: Build
         shell: bash
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 902fb0823c0..3a22b85a644 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -42,8 +42,9 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      # zizmor cache-poisoning suppression rationale: this workflow analyzes release branches but does not build or publish release artifacts.
-      - name: Set up gradle # zizmor: ignore[cache-poisoning]
+      - name: Set up gradle
+        # zizmor: ignore[cache-poisoning] This workflow analyzes release branches
+        # but does not build or publish release artifacts.
         if: matrix.language == 'java'
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
 
diff --git a/.github/workflows/detect-api-changes.yml b/.github/workflows/detect-api-changes.yml
index 05fbea37e64..bc9862ec401 100644
--- a/.github/workflows/detect-api-changes.yml
+++ b/.github/workflows/detect-api-changes.yml
@@ -4,10 +4,10 @@ on:
   # pull_request_target is used instead of pull_request so that the workflow has write access
   # (to post comments and apply labels) even when triggered by fork PRs.
   #
-  # zizmor dangerous-triggers suppression rationale: required to label and comment on fork PRs;
-  # no PR code is checked out, and
-  # the PR number and head ref are passed through env and treated only as data.
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
+  pull_request_target:
+    # zizmor: ignore[dangerous-triggers] Required to label and comment on fork PRs;
+    # no PR code is checked out, and the PR number and head ref are passed through env
+    # and treated only as data.
     types: [opened, synchronize, reopened, ready_for_review]
 
 permissions: {}
diff --git a/.github/workflows/survey-on-merged-pr.yml b/.github/workflows/survey-on-merged-pr.yml
index 22933b478ee..618b0f3515f 100644
--- a/.github/workflows/survey-on-merged-pr.yml
+++ b/.github/workflows/survey-on-merged-pr.yml
@@ -1,7 +1,9 @@
 name: Survey on Merged PR by Non-Member
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers] — this workflow only calls the reusable shared workflow; no PR code is checked out or executed.
+  pull_request_target:
+    # zizmor: ignore[dangerous-triggers] This only calls the trusted reusable
+    # workflow; no PR code is checked out or executed.
     types: [closed]
     branches: [main]