Run zizmor workflow scanner and fix issues identified.

.github/workflows/add-lockdown-label.yml

@@ -3,6 +3,11 @@ name: Add Branch Lockdown Label to PRs
 on:
   pull_request_target:
   workflow_dispatch: # Allows manual triggering of the workflow
+    branches:
+      - 'release/8.*'
+      - 'release/9.*'
+      - 'release/10.*'
+      - 'main'
 
 permissions:
   actions: write # For managing the operation state cache
@@ -11,6 +16,8 @@ permissions:
 jobs:
   add-label:
     runs-on: ubuntu-latest
+    # Only run on the main repository, not forks
+    if: github.repository == 'dotnet/sdk'
 
     permissions:
       contents: read
@@ -19,6 +26,8 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v2
+        with:
+          persist-credentials: false
 
       - name: Install jq
         run: sudo apt-get install -y jq

.github/workflows/copilot-setup-steps.yml

@@ -20,6 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Do an initial build to ensure all dependencies are restored
         continue-on-error: true
         run: |

.github/workflows/remove-lockdown-label.yml

@@ -2,15 +2,20 @@ name: Remove Lockdown Label from PRs
 
 on:
   pull_request_target:
-    types: [closed]
+    branches:
+      - 'release/8.*'
+      - 'release/9.*'
+      - 'release/10.*'
+      - 'main'
 
 permissions:
     actions: write
     pull-requests: write
 
 jobs:
     remove-labels:
-        if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'Branding')
+        # Only run on the main repository, not forks
+        if: github.event.pull_request.merged == true && contains(github.event.pull_request.labels.*.name, 'Branding') && github.repository == 'dotnet/sdk'
         runs-on: ubuntu-latest
         steps:
         -   name: PR's only change is <VersionFeature> in eng/Versions.props

.github/workflows/update-man-pages.yml

@@ -17,6 +17,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: release/10.0.1xx
+          persist-credentials: false
 
       - name: Update man-pages
         run: |

.github/workflows/update-static-web-assets-baselines.yml

@@ -24,9 +24,10 @@ jobs:
 
       - name: Checkout PR branch
         run: |
-          gh pr checkout ${{ github.event.inputs.pr_number }}
+          gh pr checkout ${GITHUB_EVENT_INPUTS_PR_NUMBER}
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_EVENT_INPUTS_PR_NUMBER: ${{ github.event.inputs.pr_number }}
 
       - name: Run build script
         id: build
@@ -79,33 +80,39 @@ jobs:
       - name: Comment on PR - No changes
         if: steps.update.outcome == 'success' && steps.check-changes.outputs.changes == 'false'
         run: |
-          gh pr comment ${{ github.event.inputs.pr_number }} \
+          gh pr comment ${GITHUB_EVENT_INPUTS_PR_NUMBER} \
             --body "No baselines were updated."
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_EVENT_INPUTS_PR_NUMBER: ${{ github.event.inputs.pr_number }}
 
       - name: Comment on PR - Changes pushed
         if: steps.commit.outcome == 'success'
         run: |
-          gh pr comment ${{ github.event.inputs.pr_number }} \
+          gh pr comment ${GITHUB_EVENT_INPUTS_PR_NUMBER} \
             --body "Baselines updated."
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_EVENT_INPUTS_PR_NUMBER: ${{ github.event.inputs.pr_number }}
 
       - name: Comment on PR - Failure
         if: steps.build.outcome == 'failure' || steps.update.outcome == 'failure' || (steps.check-changes.outputs.changes == 'true' && steps.commit.outcome == 'failure')
         run: |
           ERROR_MSG="Update baselines failed"
 
-          if [[ "${{ steps.build.outcome }}" == "failure" ]]; then
+          if [[ "${STEPS_BUILD_OUTCOME}" == "failure" ]]; then
             ERROR_MSG="$ERROR_MSG: Build script failed"
-          elif [[ "${{ steps.update.outcome }}" == "failure" ]]; then
+          elif [[ "${STEPS_UPDATE_OUTCOME}" == "failure" ]]; then
             ERROR_MSG="$ERROR_MSG: Update baselines script failed"
-          elif [[ "${{ steps.commit.outcome }}" == "failure" ]]; then
+          elif [[ "${STEPS_COMMIT_OUTCOME}" == "failure" ]]; then
             ERROR_MSG="$ERROR_MSG: Failed to commit or push changes"
           fi
 
-          gh pr comment ${{ github.event.inputs.pr_number }} \
+          gh pr comment ${GITHUB_EVENT_INPUTS_PR_NUMBER} \
             --body "$ERROR_MSG"
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STEPS_BUILD_OUTCOME: ${{ steps.build.outcome }}
+          STEPS_UPDATE_OUTCOME: ${{ steps.update.outcome }}
+          STEPS_COMMIT_OUTCOME: ${{ steps.commit.outcome }}
+          GITHUB_EVENT_INPUTS_PR_NUMBER: ${{ github.event.inputs.pr_number }}