[security] Apply zizmor template-injection suggested fixes to workflow files

.github/actions/configure_aws_artifacts_credentials/action.yml

@@ -22,9 +22,11 @@ runs:
       if: ${{ always() }}
       id: iam
       shell: bash
+      env:
+        INPUTS_RELEASE_TYPE: ${{ inputs.release_type }}
       run: |
         python build_tools/github_actions/write_artifacts_bucket_info.py \
-          --release-type "${{ inputs.release_type }}"
+          --release-type "${INPUTS_RELEASE_TYPE}"
 
     - name: Configure AWS Credentials
       if: ${{ always() && steps.iam.outputs.iam_role != '' }}

.github/actions/configure_aws_product_publication_credentials/action.yml

@@ -23,10 +23,13 @@ runs:
       if: ${{ always() }}
       id: iam
       shell: bash
+      env:
+        INPUTS_RELEASE_TYPE: ${{ inputs.release_type }}
+        INPUTS_PRODUCT: ${{ inputs.product }}
       run: |
         python build_tools/github_actions/write_product_release_bucket_info.py \
-          --release-type "${{ inputs.release_type }}" \
-          --product "${{ inputs.product }}"
+          --release-type "${INPUTS_RELEASE_TYPE}" \
+          --product "${INPUTS_PRODUCT}"
 
     - name: Configure AWS Credentials
       if: ${{ always() && steps.iam.outputs.iam_role != '' }}

.github/workflows/build_portable_linux_python_packages.yml

@@ -121,10 +121,17 @@ jobs:
     env:
       QUARTZ_REPORTING_WORKFLOW: build_portable_linux_python_packages.yml
       QUARTZ_WORKFLOW_POSTFIX: "- build ROCm Python packages"
+      ARTIFACT_GITHUB_REPO: ${{ inputs.artifact_github_repo }}
       ARTIFACT_RUN_ID: "${{ inputs.artifact_run_id != '' && inputs.artifact_run_id || github.run_id }}"
+      ARTIFACT_GROUP: ${{ inputs.artifact_group }}
+      AMDGPU_FAMILIES: ${{ inputs.amdgpu_families }}
+      LINUX_AMDGPU_FAMILIES: ${{ inputs.linux_amdgpu_families }}
+      WINDOWS_AMDGPU_FAMILIES: ${{ inputs.windows_amdgpu_families }}
+      PACKAGE_VERSION: ${{ inputs.package_version }}
+      RELEASE_TYPE: ${{ inputs.release_type }}
+      OUTPUT_ROOT: "${{ github.workspace }}"
       ARTIFACTS_DIR: "${{ github.workspace }}/artifacts"
       PACKAGES_DIR: "${{ github.workspace }}/packages"
-      RELEASE_TYPE: ${{ inputs.release_type }}
 
     steps:
       - name: "Quartz - started ${{ env.QUARTZ_WORKFLOW_POSTFIX }}"
@@ -149,37 +156,37 @@ jobs:
 
       - name: Fetch artifacts
         run: |
-          if [ -n "${{ inputs.amdgpu_families }}" ]; then
+          if [ -n "${AMDGPU_FAMILIES}" ]; then
             # Multi-arch mode: use artifact_manager.py to fetch all families
-            echo "Fetching artifacts for multiple families: ${{ inputs.amdgpu_families }}"
+            echo "Fetching artifacts for multiple families: ${AMDGPU_FAMILIES}"
             python ./build_tools/artifact_manager.py fetch \
-              --run-id="${{ env.ARTIFACT_RUN_ID }}" \
-              --run-github-repo="${{ inputs.artifact_github_repo }}" \
+              --run-id="${ARTIFACT_RUN_ID}" \
+              --run-github-repo="${ARTIFACT_GITHUB_REPO}" \
               --stage=all \
-              --amdgpu-families="${{ inputs.amdgpu_families }}" \
+              --amdgpu-families="${AMDGPU_FAMILIES}" \
               --expand-family-to-targets \
-              --output-dir="${{ github.workspace }}"
+              --output-dir="${OUTPUT_ROOT}"
               # NOTE: artifact_manager.py appends /artifacts to --output-dir
-              # in non-flatten mode, so pass workspace root here so that
-              # artifacts land in ARTIFACTS_DIR ($workspace/artifacts).
+              # in non-flatten mode, so pass OUTPUT_ROOT here so that
+              # artifacts land in ARTIFACTS_DIR ($OUTPUT_ROOT/artifacts).
           else
             # Single-family mode: use fetch_artifacts.py (backward compatible)
-            echo "Fetching artifacts for single family: ${{ inputs.artifact_group }}"
+            echo "Fetching artifacts for single family: ${ARTIFACT_GROUP}"
             python ./build_tools/fetch_artifacts.py \
-              --run-github-repo="${{ inputs.artifact_github_repo }}" \
-              --run-id="${{ env.ARTIFACT_RUN_ID }}" \
-              --artifact-group="${{ inputs.artifact_group }}" \
-              --output-dir="${{ env.ARTIFACTS_DIR }}"
+              --run-github-repo="${ARTIFACT_GITHUB_REPO}" \
+              --run-id="${ARTIFACT_RUN_ID}" \
+              --artifact-group="${ARTIFACT_GROUP}" \
+              --output-dir="${ARTIFACTS_DIR}"
           fi
 
       - name: Build Python packages
         run: |
           python ./build_tools/build_python_packages.py \
-            --artifact-dir="${{ env.ARTIFACTS_DIR }}" \
-            --dest-dir="${{ env.PACKAGES_DIR }}" \
-            --version="${{ inputs.package_version }}" \
-            --linux-amdgpu-families="${{ inputs.linux_amdgpu_families }}" \
-            --windows-amdgpu-families="${{ inputs.windows_amdgpu_families }}"
+            --artifact-dir="${ARTIFACTS_DIR}" \
+            --dest-dir="${PACKAGES_DIR}" \
+            --version="${PACKAGE_VERSION}" \
+            --linux-amdgpu-families="${LINUX_AMDGPU_FAMILIES}" \
+            --windows-amdgpu-families="${WINDOWS_AMDGPU_FAMILIES}"
 
       - name: Configure AWS Credentials
         uses: ./.github/actions/configure_aws_artifacts_credentials
@@ -193,8 +200,8 @@ jobs:
         id: upload
         run: |
           python build_tools/github_actions/upload_python_packages.py \
-            --input-packages-dir="${{ env.PACKAGES_DIR }}" \
-            --artifact-group="${{ inputs.artifact_group }}" \
+            --input-packages-dir="${PACKAGES_DIR}" \
+            --artifact-group="${ARTIFACT_GROUP}" \
             --run-id="${{ github.run_id }}" \
             ${{ inputs.multiarch_index && '--multiarch' || '' }}
 

.github/workflows/build_windows_python_packages.yml

@@ -118,10 +118,17 @@ jobs:
     env:
       QUARTZ_REPORTING_WORKFLOW: build_windows_python_packages.yml
       QUARTZ_WORKFLOW_POSTFIX: "- build ROCm Python packages"
+      ARTIFACT_GITHUB_REPO: ${{ inputs.artifact_github_repo }}
       ARTIFACT_RUN_ID: "${{ inputs.artifact_run_id != '' && inputs.artifact_run_id || github.run_id }}"
+      ARTIFACT_GROUP: ${{ inputs.artifact_group }}
+      AMDGPU_FAMILIES: ${{ inputs.amdgpu_families }}
+      LINUX_AMDGPU_FAMILIES: ${{ inputs.linux_amdgpu_families }}
+      WINDOWS_AMDGPU_FAMILIES: ${{ inputs.windows_amdgpu_families }}
+      PACKAGE_VERSION: ${{ inputs.package_version }}
+      RELEASE_TYPE: ${{ inputs.release_type }}
+      OUTPUT_ROOT: "${{ github.workspace }}"
       ARTIFACTS_DIR: "${{ github.workspace }}/artifacts"
       PACKAGES_DIR: "${{ github.workspace }}/packages"
-      RELEASE_TYPE: ${{ inputs.release_type }}
     defaults:
       run:
         shell: bash
@@ -152,37 +159,37 @@ jobs:
 
       - name: Fetch artifacts
         run: |
-          if [ -n "${{ inputs.amdgpu_families }}" ]; then
+          if [ -n "${AMDGPU_FAMILIES}" ]; then
             # Multi-arch mode: use artifact_manager.py to fetch all families
-            echo "Fetching artifacts for multiple families: ${{ inputs.amdgpu_families }}"
+            echo "Fetching artifacts for multiple families: ${AMDGPU_FAMILIES}"
             python ./build_tools/artifact_manager.py fetch \
-              --run-id="${{ env.ARTIFACT_RUN_ID }}" \
-              --run-github-repo="${{ inputs.artifact_github_repo }}" \
+              --run-id="${ARTIFACT_RUN_ID}" \
+              --run-github-repo="${ARTIFACT_GITHUB_REPO}" \
               --stage=all \
-              --amdgpu-families="${{ inputs.amdgpu_families }}" \
+              --amdgpu-families="${AMDGPU_FAMILIES}" \
               --expand-family-to-targets \
-              --output-dir="${{ github.workspace }}"
+              --output-dir="${OUTPUT_ROOT}"
               # NOTE: artifact_manager.py appends /artifacts to --output-dir
-              # in non-flatten mode, so pass workspace root here so that
-              # artifacts land in ARTIFACTS_DIR ($workspace/artifacts).
+              # in non-flatten mode, so pass OUTPUT_ROOT here so that
+              # artifacts land in ARTIFACTS_DIR ($OUTPUT_ROOT/artifacts).
           else
             # Single-family mode: use fetch_artifacts.py (backward compatible)
-            echo "Fetching artifacts for single family: ${{ inputs.artifact_group }}"
+            echo "Fetching artifacts for single family: ${ARTIFACT_GROUP}"
             python ./build_tools/fetch_artifacts.py \
-              --run-github-repo="${{ inputs.artifact_github_repo }}" \
-              --run-id="${{ env.ARTIFACT_RUN_ID }}" \
-              --artifact-group="${{ inputs.artifact_group }}" \
-              --output-dir="${{ env.ARTIFACTS_DIR }}"
+              --run-github-repo="${ARTIFACT_GITHUB_REPO}" \
+              --run-id="${ARTIFACT_RUN_ID}" \
+              --artifact-group="${ARTIFACT_GROUP}" \
+              --output-dir="${ARTIFACTS_DIR}"
           fi
 
       - name: Build Python packages
         run: |
           python ./build_tools/build_python_packages.py \
-            --artifact-dir="${{ env.ARTIFACTS_DIR }}" \
-            --dest-dir="${{ env.PACKAGES_DIR }}" \
-            --version="${{ inputs.package_version }}" \
-            --linux-amdgpu-families="${{ inputs.linux_amdgpu_families }}" \
-            --windows-amdgpu-families="${{ inputs.windows_amdgpu_families }}"
+            --artifact-dir="${ARTIFACTS_DIR}" \
+            --dest-dir="${PACKAGES_DIR}" \
+            --version="${PACKAGE_VERSION}" \
+            --linux-amdgpu-families="${LINUX_AMDGPU_FAMILIES}" \
+            --windows-amdgpu-families="${WINDOWS_AMDGPU_FAMILIES}"
 
       - name: Configure AWS Credentials
         uses: ./.github/actions/configure_aws_artifacts_credentials
@@ -196,8 +203,8 @@ jobs:
         id: upload
         run: |
           python build_tools/github_actions/upload_python_packages.py \
-            --input-packages-dir="${{ env.PACKAGES_DIR }}" \
-            --artifact-group="${{ inputs.artifact_group }}" \
+            --input-packages-dir="${PACKAGES_DIR}" \
+            --artifact-group="${ARTIFACT_GROUP}" \
             --run-id="${{ github.run_id }}" \
             ${{ inputs.multiarch_index && '--multiarch' || '' }}
 

.github/workflows/bump_submodules.yml

@@ -41,6 +41,9 @@ jobs:
       contents: read
       pull-requests: write
 
+    env:
+      INPUT_SUBMODULE: ${{ github.event.inputs.submodule || 'all' }}
+
     steps:
       - name: Checkout ROCm/TheRock
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -50,9 +53,11 @@ jobs:
       - name: Select scheduled submodule
         id: schedule
         if: github.event_name == 'schedule'
+        env:
+          EVENT_SCHEDULE: ${{ github.event.schedule }}
         run: |
           submodules=()
-          case "${{ github.event.schedule }}" in
+          case "${EVENT_SCHEDULE}" in
             "0 */12 * * *") submodules+=("rocgdb" "mesa-fork") ;;
             "0 7 * * *") submodules+=("rocm-systems" "rocm-libraries") ;;
             "0 16 * * *") submodules+=("rocm-systems") ;;
@@ -90,47 +95,60 @@ jobs:
 
       - name: Run scheduled bump automation
         if: github.event_name == 'schedule' && steps.schedule.outputs.submodules != ''
+        env:
+          SCHEDULE_SUBMODULES: ${{ steps.schedule.outputs.submodules }}
+          SYSTEMS_TOKEN: ${{ steps.systems-token.outputs.token }}
+          LIBRARIES_TOKEN: ${{ steps.librarian-token.outputs.token }}
         run: |
-          for submodule in ${{ steps.schedule.outputs.submodules }}; do
+          for submodule in ${SCHEDULE_SUBMODULES}; do
             python3 build_tools/github_actions/bump_automation.py \
               --event_type "schedule" \
               --submodule "${submodule}" \
-              --systems_token "${{ steps.systems-token.outputs.token }}" \
-              --libraries_token "${{ steps.librarian-token.outputs.token }}" \
-              --rocgdb_token "${{ steps.systems-token.outputs.token }}" \
-              --mesa_token "${{ steps.systems-token.outputs.token }}"
+              --systems_token "${SYSTEMS_TOKEN}" \
+              --libraries_token "${LIBRARIES_TOKEN}" \
+              --rocgdb_token "${SYSTEMS_TOKEN}" \
+              --mesa_token "${SYSTEMS_TOKEN}"
           done
 
       - name: Run manually dispatched bump automation
         if: github.event_name == 'workflow_dispatch'
+        env:
+          SYSTEMS_TOKEN: ${{ steps.systems-token.outputs.token }}
+          LIBRARIES_TOKEN: ${{ steps.librarian-token.outputs.token }}
         run: |
           python3 build_tools/github_actions/bump_automation.py \
             --event_type "schedule" \
-            --submodule "${{ github.event.inputs.submodule || 'all' }}" \
-            --systems_token "${{ steps.systems-token.outputs.token }}" \
-            --libraries_token "${{ steps.librarian-token.outputs.token }}" \
-            --rocgdb_token "${{ steps.systems-token.outputs.token }}" \
-            --mesa_token "${{ steps.systems-token.outputs.token }}"
+            --submodule "${INPUT_SUBMODULE}" \
+            --systems_token "${SYSTEMS_TOKEN}" \
+            --libraries_token "${LIBRARIES_TOKEN}" \
+            --rocgdb_token "${SYSTEMS_TOKEN}" \
+            --mesa_token "${SYSTEMS_TOKEN}"
 
       - name: Run push automation
         if: github.event_name == 'push'
+        env:
+          SYSTEMS_TOKEN: ${{ steps.systems-token.outputs.token }}
+          LIBRARIES_TOKEN: ${{ steps.librarian-token.outputs.token }}
         run: |
           python3 build_tools/github_actions/bump_automation.py \
             --event_type "push" \
             --before "${{ github.event.before }}" \
             --after "${{ github.sha }}" \
-            --systems_token "${{ steps.systems-token.outputs.token }}" \
-            --libraries_token "${{ steps.librarian-token.outputs.token }}" \
-            --rocgdb_token "${{ steps.systems-token.outputs.token }}" \
-            --mesa_token "${{ steps.systems-token.outputs.token }}"
+            --systems_token "${SYSTEMS_TOKEN}" \
+            --libraries_token "${LIBRARIES_TOKEN}" \
+            --rocgdb_token "${SYSTEMS_TOKEN}" \
+            --mesa_token "${SYSTEMS_TOKEN}"
 
       - name: Post bump breadcrumbs to upstream PRs
         if: github.event_name == 'push'
         continue-on-error: true
+        env:
+          SYSTEMS_TOKEN: ${{ steps.systems-token.outputs.token }}
+          LIBRARIES_TOKEN: ${{ steps.librarian-token.outputs.token }}
         run: |
           python3 build_tools/github_actions/post_bump_breadcrumbs.py \
             --before "${{ github.event.before }}" \
             --after "${{ github.sha }}" \
-            --systems_token "${{ steps.systems-token.outputs.token }}" \
-            --libraries_token "${{ steps.librarian-token.outputs.token }}" \
-            --rocgdb_token "${{ steps.systems-token.outputs.token }}"
+            --systems_token "${SYSTEMS_TOKEN}" \
+            --libraries_token "${LIBRARIES_TOKEN}" \
+            --rocgdb_token "${SYSTEMS_TOKEN}"