From 05807aeca8ebc9302736a4c68c6dbd8d56c0a263 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:13 -0700
Subject: [PATCH 01/13] Add shared zizmor workflow

---
 .github/workflows/zizmor.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 .github/workflows/zizmor.yml

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000000..61d7b7e5153
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,18 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '43 18 * * 5'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  zizmor:
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1
\ No newline at end of file

From 793e219a7da7691f5ef589dfb771e90bd25d3ea8 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:13 -0700
Subject: [PATCH 02/13] Fix blocking zizmor findings

---
 .github/workflows/backport.yml               | 1 +
 .github/workflows/build.yml                  | 3 ++-
 .github/workflows/codeql.yml                 | 3 ++-
 .github/workflows/detect-api-changes.yml     | 9 +++++----
 .github/workflows/prepare-patch-release.yml  | 1 +
 .github/workflows/prepare-release-branch.yml | 2 ++
 .github/workflows/release.yml                | 1 +
 7 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index be5fed5650c..5b92dcaffd8 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -34,6 +34,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request
         env:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8cdf11b7a99..4d68eed89fd 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -56,7 +56,8 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      - name: Set up gradle
+      # This tests release branches but does not publish release artifacts.
+      - name: Set up gradle # zizmor: ignore[cache-poisoning]
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
       - name: Build
         run: >
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1346228c29c..af677005674 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,8 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      - name: Set up gradle
+      # This analyzes release branches but does not build or publish release artifacts.
+      - name: Set up gradle # zizmor: ignore[cache-poisoning]
         if: matrix.language == 'java'
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
 
diff --git a/.github/workflows/detect-api-changes.yml b/.github/workflows/detect-api-changes.yml
index a3fffc04a79..ee84f99fd6b 100644
--- a/.github/workflows/detect-api-changes.yml
+++ b/.github/workflows/detect-api-changes.yml
@@ -4,10 +4,9 @@ on:
   # pull_request_target is used instead of pull_request so that the workflow has write access
   # (to post comments and apply labels) even when triggered by fork PRs.
   #
-  # SECURITY: this workflow must never checkout or execute any code from the PR branch.
-  # Doing so would allow malicious PRs to exfiltrate secrets. All we use from the PR
-  # is github.event.pull_request.number (an integer), which is safe.
-  pull_request_target:
+  # Required to label and comment on fork PRs; no PR code is checked out, and
+  # the PR number and head ref are passed through env and treated only as data.
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, synchronize, reopened, ready_for_review]
 
 permissions: {}
@@ -23,6 +22,8 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-issues: write
+          permission-pull-requests: read
 
       - name: Check for API changes and update PR
         env:
diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml
index 040df74da66..7f3e65ddfa9 100644
--- a/.github/workflows/prepare-patch-release.yml
+++ b/.github/workflows/prepare-patch-release.yml
@@ -52,6 +52,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request
         env:
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index d0af0f2b414..7407b3b05a9 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -68,6 +68,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against the release branch
         env:
@@ -124,6 +125,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against main
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 35d9da2b3af..e945d6c331c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -219,6 +219,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against main
         env:

From df9e8512d9824ba861f04cb4987bbc7bb00aa0c3 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:14 -0700
Subject: [PATCH 03/13] Add shared zizmor workflow

---
 .github/workflows/zizmor.yml | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 61d7b7e5153..59a032ba4e2 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -9,10 +9,11 @@ on:
     - cron: '43 18 * * 5'
   workflow_dispatch:
 
-permissions:
-  contents: read
-  security-events: write
+permissions: {}
 
 jobs:
   zizmor:
+    permissions:
+      contents: read # for actions/checkout
+      security-events: write # for zizmor to upload SARIF results
     uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1
\ No newline at end of file

From 997d97eeccdf710338c9cf431fb79bbb37eabf75 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:14 -0700
Subject: [PATCH 04/13] Add trailing newline

---
 .github/workflows/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 59a032ba4e2..45e4436c9bb 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -16,4 +16,4 @@ jobs:
     permissions:
       contents: read # for actions/checkout
       security-events: write # for zizmor to upload SARIF results
-    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1
\ No newline at end of file
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1

From 145fab7cfeb114119b8a13070e717d922a7a5453 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:14 -0700
Subject: [PATCH 05/13] Clarify CodeQL release branch comment

---
 .github/workflows/codeql.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index af677005674..82f07c9e7ac 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -40,7 +40,7 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      # This analyzes release branches but does not build or publish release artifacts.
+      # This workflow analyzes release branches but does not build or publish release artifacts.
       - name: Set up gradle # zizmor: ignore[cache-poisoning]
         if: matrix.language == 'java'
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0

From d542326cced575fbf47a215679eb951e2d56c3d1 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:15 -0700
Subject: [PATCH 06/13] Document zizmor schedule

---
 .github/workflows/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 45e4436c9bb..c7f7115d35f 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -6,7 +6,7 @@ on:
   pull_request:
     branches: [main]
   schedule:
-    - cron: '43 18 * * 5'
+    - cron: '43 18 * * 5' # weekly at 18:43 UTC on Friday
   workflow_dispatch:
 
 permissions: {}

From 927eaa401d0d142ebb640c0a7e3e20b9c73784e0 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:15 -0700
Subject: [PATCH 07/13] Run zizmor on all pull requests

---
 .github/workflows/zizmor.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index c7f7115d35f..4c9b6cbdc10 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -4,7 +4,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
   schedule:
     - cron: '43 18 * * 5' # weekly at 18:43 UTC on Friday
   workflow_dispatch:

From f2415da0346e0af377f47d2cf924959ab9ed9e06 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:16 -0700
Subject: [PATCH 08/13] Scan release branch pushes with zizmor

---
 .github/workflows/zizmor.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 4c9b6cbdc10..4d9118803f4 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -2,7 +2,9 @@ name: Zizmor
 
 on:
   push:
-    branches: [main]
+    branches:
+      - main
+      - release/*
   pull_request:
   schedule:
     - cron: '43 18 * * 5' # weekly at 18:43 UTC on Friday

From 4d9104217e6b1600e4b150feec99ceb5aaca3244 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:16 -0700
Subject: [PATCH 09/13] Update shared zizmor workflow to v0.4.0

---
 .github/workflows/zizmor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 4d9118803f4..d97b5797db1 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -17,4 +17,4 @@ jobs:
     permissions:
       contents: read # for actions/checkout
       security-events: write # for zizmor to upload SARIF results
-    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@62d5939b47144252763c5ff9fffe8c20d76cd806 # v0.4.0

From 77f553a49f24b6ce501a0fb5a797092fdc2d2760 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 19:34:17 -0700
Subject: [PATCH 10/13] ci: remediate zizmor findings

---
 .github/workflows/backport.yml                           | 1 +
 .github/workflows/benchmark-tags.yml                     | 1 +
 .github/workflows/benchmark.yml                          | 2 ++
 .github/workflows/build-daily.yml                        | 2 ++
 .github/workflows/build-tracecontext-testsuite.yml       | 2 ++
 .github/workflows/build.yml                              | 7 ++++++-
 .github/workflows/codeql.yml                             | 2 ++
 .github/workflows/fossa.yml                              | 2 ++
 .github/workflows/gradle-wrapper-validation.yml          | 2 ++
 .github/workflows/issue-management-feedback-label.yml    | 2 ++
 .github/workflows/javadoc-crawler.yml                    | 2 ++
 .github/workflows/prepare-patch-release.yml              | 2 ++
 .github/workflows/prepare-release-branch.yml             | 8 ++++++++
 .github/workflows/release.yml                            | 9 +++++++++
 .github/workflows/reusable-link-check.yml                | 1 +
 .../workflows/sonatype-guide-dependency-audit-daily.yml  | 2 ++
 16 files changed, 46 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 5b92dcaffd8..744c05ff0fc 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -25,6 +25,7 @@ jobs:
         with:
           # history is needed to run git cherry-pick below
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Use CLA approved github bot
         run: .github/scripts/use-cla-approved-bot.sh
diff --git a/.github/workflows/benchmark-tags.yml b/.github/workflows/benchmark-tags.yml
index b9c597584b4..88f5596c0e8 100644
--- a/.github/workflows/benchmark-tags.yml
+++ b/.github/workflows/benchmark-tags.yml
@@ -25,6 +25,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: ${{ matrix.tag-version }}
+          persist-credentials: false
 
       - id: setup-java
         name: Set up Java for build
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index d479e73eb9f..9fa7e6aeb0f 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -28,6 +28,8 @@ jobs:
         run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - id: setup-java
         name: Set up Java for build
diff --git a/.github/workflows/build-daily.yml b/.github/workflows/build-daily.yml
index ce7bcbded10..5a2d8671deb 100644
--- a/.github/workflows/build-daily.yml
+++ b/.github/workflows/build-daily.yml
@@ -20,6 +20,8 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Java
         uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
diff --git a/.github/workflows/build-tracecontext-testsuite.yml b/.github/workflows/build-tracecontext-testsuite.yml
index 39bd88f3c5e..e8cff209db0 100644
--- a/.github/workflows/build-tracecontext-testsuite.yml
+++ b/.github/workflows/build-tracecontext-testsuite.yml
@@ -21,6 +21,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Login to GitHub package registry
         uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4d68eed89fd..4d7676d0fb4 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -40,6 +40,8 @@ jobs:
             jmh-based-tests: true
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - id: setup-java-test
         name: Set up Java ${{ matrix.test-java-version }} for tests
@@ -64,9 +66,10 @@ jobs:
             ./gradlew build
             ${{ matrix.coverage && 'jacocoTestReport' || '' }}
             -PtestJavaVersion=${{ matrix.test-java-version }}
-            "-Porg.gradle.java.installations.paths=${{ steps.setup-java-test.outputs.path }}"
+            "-Porg.gradle.java.installations.paths=${TEST_JAVA_PATH}"
             "-Porg.gradle.java.installations.auto-download=false"
         env:
+          TEST_JAVA_PATH: ${{ steps.setup-java-test.outputs.path }}
           # JMH-based tests run only if this environment variable is set to true
           RUN_JMH_BASED_TESTS: ${{ matrix.jmh-based-tests }}
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -116,6 +119,8 @@ jobs:
           - 25 # renovate(graal-java-version)
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
       - uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd # v1.6.3
         with:
           java-version: ${{ matrix.test-graal-version }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 82f07c9e7ac..aeca184f912 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,6 +32,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Java 21
         if: matrix.language == 'java'
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index 4c6a61a31b4..ef87d73cf84 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
         with:
diff --git a/.github/workflows/gradle-wrapper-validation.yml b/.github/workflows/gradle-wrapper-validation.yml
index 62522858c51..6c2dfc7994a 100644
--- a/.github/workflows/gradle-wrapper-validation.yml
+++ b/.github/workflows/gradle-wrapper-validation.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       # this needs to be in its own workflow in order to make OSSF scorecard happy
       - uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
diff --git a/.github/workflows/issue-management-feedback-label.yml b/.github/workflows/issue-management-feedback-label.yml
index 56664b31c25..a9b5b4d845d 100644
--- a/.github/workflows/issue-management-feedback-label.yml
+++ b/.github/workflows/issue-management-feedback-label.yml
@@ -19,6 +19,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Remove labels
         env:
diff --git a/.github/workflows/javadoc-crawler.yml b/.github/workflows/javadoc-crawler.yml
index c8665a122da..4d4f5499cf6 100644
--- a/.github/workflows/javadoc-crawler.yml
+++ b/.github/workflows/javadoc-crawler.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
         with:
diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml
index 7f3e65ddfa9..2cb48c89882 100644
--- a/.github/workflows/prepare-patch-release.yml
+++ b/.github/workflows/prepare-patch-release.yml
@@ -12,6 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - run: |
           if [[ ! $GITHUB_REF_NAME =~ ^release/v[0-9]+\.[0-9]+\.x$ ]]; then
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index 7407b3b05a9..b7ed25ba620 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Verify prerequisites
         run: |
@@ -35,9 +37,13 @@ jobs:
           # history is needed to allow fast-forward push below in case
           # re-running this workflow after merging additional PRs to main
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Create release branch
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
+          gh auth setup-git
           version=$(.github/scripts/get-version.sh)
           version=${version//-SNAPSHOT/}
           if [[ $version =~ ^([0-9]+)\.([0-9]+)\.0$ ]]; then
@@ -93,6 +99,8 @@ jobs:
       - prereqs
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set environment variables
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e945d6c331c..bdf580d2f72 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,6 +22,8 @@ jobs:
           fi
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
         with:
@@ -71,6 +73,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
+          persist-credentials: false
 
       - name: Check that change log update was merged to main
         run: |
@@ -87,6 +90,7 @@ jobs:
         with:
           # tags are needed for the generate-release-contributors.sh script
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Generate release notes
         env:
@@ -146,6 +150,8 @@ jobs:
       # add change log sync (if any) into this PR since the apidiff update
       # is required before any other PR can be merged anyway
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Copy change log section from release branch
         env:
@@ -157,6 +163,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: main
+          persist-credentials: false
 
       - name: Merge change log to main
         env:
@@ -219,6 +226,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against main
@@ -227,6 +235,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Post-release updates for $VERSION"
           body="Post-release updates for \`$VERSION\`."
           branch="otelbot/post-release-updates-${VERSION}"
diff --git a/.github/workflows/reusable-link-check.yml b/.github/workflows/reusable-link-check.yml
index 59fc7dcac7b..0af1e753659 100644
--- a/.github/workflows/reusable-link-check.yml
+++ b/.github/workflows/reusable-link-check.yml
@@ -13,6 +13,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0 # needed for merge-base used in modified-files mode
+          persist-credentials: false
 
       - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
 
diff --git a/.github/workflows/sonatype-guide-dependency-audit-daily.yml b/.github/workflows/sonatype-guide-dependency-audit-daily.yml
index a09c000579f..ee3512c0067 100644
--- a/.github/workflows/sonatype-guide-dependency-audit-daily.yml
+++ b/.github/workflows/sonatype-guide-dependency-audit-daily.yml
@@ -17,6 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-java@0f481fcb613427c0f801b606911222b5b6f3083a # v5.5.0
         with:

From f3435d1d2057fb5962d6cf79d77893f8a849e108 Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:01:20 -0700
Subject: [PATCH 11/13] ci: preserve authenticated workflow pushes

---
 .github/workflows/backport.yml               | 2 ++
 .github/workflows/build.yml                  | 1 +
 .github/workflows/prepare-patch-release.yml  | 2 ++
 .github/workflows/prepare-release-branch.yml | 2 ++
 4 files changed, 7 insertions(+)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 744c05ff0fc..9fe6c762e81 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -35,6 +35,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request
@@ -43,6 +44,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
           title=$(gh pr view $NUMBER --json title --jq .title)
 
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4d7676d0fb4..26a8ba90975 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -62,6 +62,7 @@ jobs:
       - name: Set up gradle # zizmor: ignore[cache-poisoning]
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
       - name: Build
+        shell: bash
         run: >
             ./gradlew build
             ${{ matrix.coverage && 'jacocoTestReport' || '' }}
diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml
index 2cb48c89882..f141fd82b54 100644
--- a/.github/workflows/prepare-patch-release.yml
+++ b/.github/workflows/prepare-patch-release.yml
@@ -54,6 +54,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request
@@ -61,6 +62,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Prepare release $VERSION"
           branch="otelbot/prepare-release-${VERSION}"
 
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index b7ed25ba620..b3253b71395 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -74,6 +74,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against the release branch
@@ -140,6 +141,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Update version to $NEXT_VERSION"
           body="Update version to \`$NEXT_VERSION\`."
           branch="otelbot/update-version-to-${NEXT_VERSION}"

From 8f865cbc9adc197b34f253bce6c0547074826b1f Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:27:06 -0700
Subject: [PATCH 12/13] ci: authenticate release pull request push

---
 .github/workflows/prepare-release-branch.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index b3253b71395..432622ad67b 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -82,6 +82,7 @@ jobs:
           # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
           GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
+          gh auth setup-git
           message="Prepare release $VERSION"
           branch="otelbot/prepare-release-${VERSION}"
 

From 38040418caa520411810dc63efce9641ded4e11d Mon Sep 17 00:00:00 2001
From: OpenTelemetry Bot <107717825+opentelemetrybot@users.noreply.github.com>
Date: Mon, 20 Jul 2026 20:48:38 -0700
Subject: [PATCH 13/13] ci: preserve workflow push credentials

---
 .github/workflows/backport.yml               | 17 ++++++-------
 .github/workflows/prepare-patch-release.yml  | 13 +++++-----
 .github/workflows/prepare-release-branch.yml | 25 +++++++++++---------
 .github/workflows/release.yml                | 13 +++++-----
 4 files changed, 37 insertions(+), 31 deletions(-)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 9fe6c762e81..c076bda0c7b 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -35,24 +35,25 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
-          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request
         env:
           NUMBER: ${{ github.event.inputs.number }}
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
-          commit=$(gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
-          title=$(gh pr view $NUMBER --json title --jq .title)
+          commit=$(GH_TOKEN="$OTELBOT_TOKEN" gh pr view $NUMBER --json mergeCommit --jq .mergeCommit.oid)
+          title=$(GH_TOKEN="$OTELBOT_TOKEN" gh pr view $NUMBER --json title --jq .title)
 
           branch="otelbot/backport-${NUMBER}-to-${GITHUB_REF_NAME//\//-}"
 
           git checkout -b $branch
           git cherry-pick $commit
           git push --set-upstream origin $branch
-          gh pr create --title "[$GITHUB_REF_NAME] $title" \
-                       --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
-                       --base $GITHUB_REF_NAME
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "[$GITHUB_REF_NAME] $title" \
+            --body "Clean cherry-pick of #$NUMBER to the \`$GITHUB_REF_NAME\` branch." \
+            --base $GITHUB_REF_NAME
diff --git a/.github/workflows/prepare-patch-release.yml b/.github/workflows/prepare-patch-release.yml
index f141fd82b54..12a48e74689 100644
--- a/.github/workflows/prepare-patch-release.yml
+++ b/.github/workflows/prepare-patch-release.yml
@@ -54,13 +54,13 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
-          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
           message="Prepare release $VERSION"
@@ -69,6 +69,7 @@ jobs:
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "[$GITHUB_REF_NAME] $message" \
-                       --body "$message." \
-                       --base $GITHUB_REF_NAME
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "[$GITHUB_REF_NAME] $message" \
+            --body "$message." \
+            --base $GITHUB_REF_NAME
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index 432622ad67b..b89b36a8fd1 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -74,13 +74,13 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
-          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against the release branch
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
           message="Prepare release $VERSION"
@@ -89,9 +89,10 @@ jobs:
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "[$RELEASE_BRANCH_NAME] $message" \
-                       --body "$message." \
-                       --base $RELEASE_BRANCH_NAME
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "[$RELEASE_BRANCH_NAME] $message" \
+            --body "$message." \
+            --base $RELEASE_BRANCH_NAME
 
   create-pull-request-against-main:
     permissions:
@@ -139,8 +140,9 @@ jobs:
 
       - name: Create pull request against main
         env:
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
           message="Update version to $NEXT_VERSION"
@@ -150,6 +152,7 @@ jobs:
           git checkout -b $branch
           git commit -a -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "$message" \
-                       --body "$body" \
-                       --base main
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "$message" \
+            --body "$body" \
+            --base main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bdf580d2f72..7231a54779c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -226,14 +226,14 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
-          permission-contents: write
           permission-pull-requests: write
 
       - name: Create pull request against main
         env:
           VERSION: ${{ needs.release.outputs.version }}
-          # not using secrets.GITHUB_TOKEN since pull requests from that token do not run workflows
-          GH_TOKEN: ${{ steps.otelbot-token.outputs.token }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # pull requests from secrets.GITHUB_TOKEN do not run workflows
+          OTELBOT_TOKEN: ${{ steps.otelbot-token.outputs.token }}
         run: |
           gh auth setup-git
           message="Post-release updates for $VERSION"
@@ -243,6 +243,7 @@ jobs:
           git checkout -b $branch
           git commit -m "$message"
           git push --set-upstream origin $branch
-          gh pr create --title "$message" \
-                       --body "$body" \
-                       --base main
+          GH_TOKEN="$OTELBOT_TOKEN" gh pr create \
+            --title "$message" \
+            --body "$body" \
+            --base main