From 083a0d9605621e380e83de5fac61f3699f86a3d5 Mon Sep 17 00:00:00 2001
From: Husam <husameldawi@google.com>
Date: Wed, 1 Jul 2026 01:40:32 +0000
Subject: [PATCH 1/3] chore(actions): address zizmor findings

This PR is an auto-generated attempt to address zizmor findings. It may not catch everything, and should be reviewed by repository owners. If it is unhelpful, feel free to close the PR and address separately.

This PR was generated by running `zizmor --fix=all --gh-token=$(gh auth token) ./.github/workflows`. See go/github-zizmor-help for instructions to install and run.

If this PR is helpful, feel free to approve and merge, or edit/modify as needed to get it to the right state. Repository owners must ultimately ensure compliance by 2026-07-13. The purpose of this PR is to provide some assistance with achieving that as a first pass. This will become a blocking check for new changes to github workflows on 2026-07-13 within the `googleapis` org.

There may be some ignored findings (with the comment `# zizmor: ignore[...]`), which you may fix if feasible.
---
 .github/workflows/build.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 0ed615da..5b087da4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,3 +1,6 @@
+permissions:
+  contents: read
+
 name: Build
 on: [push, pull_request]
 jobs:
@@ -7,12 +10,13 @@ jobs:
       DOTNET_NOLOGO: true
 
     steps:	
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
       with:	
-        submodules: true	
+        submodules: true
+        persist-credentials: false	
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v5
+      uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
       with:
         dotnet-version: 8.0.x
 

From f4069e6150fb2cdec0494d71a4341ae88ccb0108 Mon Sep 17 00:00:00 2001
From: Husam <husameldawi@google.com>
Date: Wed, 1 Jul 2026 02:44:08 +0000
Subject: [PATCH 2/3] chore(renovate): replace config:base/recommended with
 best-practices

---
 .github/renovate.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/renovate.json b/.github/renovate.json
index 94182fac..ecdd93c7 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,6 +1,6 @@
 {
   "extends": [
-    "config:base",
+    "config:best-practices",
     ":disableDependencyDashboard"
   ],
   "ignorePresets": [":ignoreModulesAndTests"],

From 350673f8cc9afc4ec92a458554f65ea5cf521da1 Mon Sep 17 00:00:00 2001
From: Husam <husameldawi@google.com>
Date: Wed, 1 Jul 2026 03:41:18 +0000
Subject: [PATCH 3/3] fix(actions): remove trailing tab characters from
 build.yml

---
 .github/workflows/build.yml | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 5b087da4..f2acb218 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -6,21 +6,21 @@ on: [push, pull_request]
 jobs:
   build:
     runs-on: ubuntu-latest
-    env:	
+    env:
       DOTNET_NOLOGO: true
 
-    steps:	
+    steps:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      with:	
+      with:
         submodules: true
-        persist-credentials: false	
+        persist-credentials: false
 
     - name: Setup .NET
       uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
       with:
         dotnet-version: 8.0.x
 
-    - name: Build and test	
+    - name: Build and test
       run: |
         dotnet build
         dotnet test Google.Api.Generator.Tests --logger:"console;noprogress=true"