From ec605f72cfe33f93b3203899bb372ba58ec816a1 Mon Sep 17 00:00:00 2001
From: Nathaniel Mitchell <nathaniel.p.mitchell@intel.com>
Date: Thu, 15 Jan 2026 16:22:17 -0800
Subject: [PATCH] Fix potential CI issues. source: zizmor

Signed-off-by: Nathaniel Mitchell <nathaniel.p.mitchell@intel.com>
---
 .github/dependabot.yml                  |  6 ++++++
 .github/workflows/codeql.yml            |  2 ++
 .github/workflows/dependency-review.yml |  3 +++
 .github/workflows/tests.yml             | 10 +++++++++-
 4 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c7b46c3f..e95d8f8b 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,13 +4,19 @@ updates:
     directory: /
     schedule:
       interval: daily
+    cooldown:
+      default-days: 3
 
   - package-ecosystem: docker
     directory: /chipsec_tools/log_parser
     schedule:
       interval: daily
+    cooldown:
+      default-days: 3
 
   - package-ecosystem: pip
     directory: /chipsec_tools/log_parser
     schedule:
       interval: daily
+    cooldown:
+      default-days: 3
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9a220382..4b734883 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -33,6 +33,8 @@ jobs:
 
       - name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
 
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 93101e79..7f527980 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -23,5 +23,8 @@ jobs:
 
       - name: 'Checkout Repository'
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          persist-credentials: false
+
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index fbf1d8d6..88cec3ba 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -37,6 +37,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        persist-credentials: false
 
     - name: Install Alpine dependencies
       if: matrix.distro.name == 'alpine'
@@ -174,6 +176,8 @@ jobs:
         egress-policy: audit
 
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.versions.python }}
       uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
@@ -249,6 +253,8 @@ jobs:
         python-version: ${{ matrix.versions.python }}
 
     - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      with:
+        persist-credentials: false
 
     - name: Patch chipsec_main to return true even when some module failed
       run: |
@@ -296,7 +302,9 @@ jobs:
 
     - name: Run Python pytest
       run: |
-        python -m pytest --cov . --cov-report=term-missing --cov-fail-under="${{ env.CODE_COVERAGE_REQ }}"
+        python -m pytest --cov . --cov-report=term-missing --cov-fail-under="${COV_REQ}"
+      env:
+        COV_REQ: ${{ env.CODE_COVERAGE_REQ }}
         
     - name: Run xml cfg checker
       run: |