From b9f2f91fd64ee984ad8a5e707a1f60e8149c8ffc Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 18:45:12 +0000
Subject: [PATCH 01/12] ci: resolve Zizmor static security audit findings in
 workflows and actions

- Fix template injection in .github/reusable-build/action.yml by passing inputs via env
- Pin all action references to immutable commit SHAs
- Add explicit top-level 'permissions: contents: read' blocks
- Set 'persist-credentials: false' on checkout steps
---
 .github/reusable-build/action.yml |  9 +++++----
 .github/workflows/cd-docs.yml     | 10 +++++++---
 .github/workflows/conda-build.yml | 18 +++++++++++++-----
 .github/workflows/conda-test.yml  |  9 +++++++--
 .github/workflows/lint.yml        | 11 ++++++++---
 5 files changed, 40 insertions(+), 17 deletions(-)

diff --git a/.github/reusable-build/action.yml b/.github/reusable-build/action.yml
index 8997fb4a6..1e68d11ba 100644
--- a/.github/reusable-build/action.yml
+++ b/.github/reusable-build/action.yml
@@ -9,7 +9,7 @@ runs:
   steps:
 
   - name: Set up Python ${{ inputs.python-version }}
-    uses: actions/setup-python@v5
+    uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
     with:
       python-version: ${{ inputs.python-version }}
 
@@ -20,14 +20,15 @@ runs:
 
   - name: Build the package for Python ${{ inputs.python-version }}
     shell: bash
+    env:
+      PYTHON_VERSION: ${{ inputs.python-version }}
     run: |
-      version="${{ inputs.python-version }}"
-      DOCKER_SERVICE=manylinux-python$(echo "$version" | sed 's/\.//')
+      DOCKER_SERVICE=manylinux-python$(echo "$PYTHON_VERSION" | sed 's/\.//')
       docker compose build ${DOCKER_SERVICE}
       docker compose run ${DOCKER_SERVICE}
 
   - name: Upload wheel artifact for Python ${{ inputs.python-version }}
-    uses: actions/upload-artifact@v4.4.0
+    uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
     with:
       name: ml-metadata-wheel-py${{ inputs.python-version }}
       path: dist/*.whl
diff --git a/.github/workflows/cd-docs.yml b/.github/workflows/cd-docs.yml
index cc529ce4c..e9d29de1a 100644
--- a/.github/workflows/cd-docs.yml
+++ b/.github/workflows/cd-docs.yml
@@ -5,17 +5,21 @@ on:
     branches:
       - 'master'
   pull_request:
+
 permissions:
   contents: write
+
 jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
           python-version: '3.12'
           cache: 'pip'
@@ -26,7 +30,7 @@ jobs:
         run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
 
       - name: Caching
-        uses: actions/cache@v4
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           key: mkdocs-material-${{ env.cache_id }}
           path: .cache
diff --git a/.github/workflows/conda-build.yml b/.github/workflows/conda-build.yml
index 21e7ebac1..740c6b55e 100644
--- a/.github/workflows/conda-build.yml
+++ b/.github/workflows/conda-build.yml
@@ -11,6 +11,9 @@ on:
     types: [published]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ${{ matrix.os }}
@@ -22,10 +25,12 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Setup Micromamba
-      uses: mamba-org/setup-micromamba@v1
+      uses: mamba-org/setup-micromamba@4b9113af4fba0e9e1124b252dd6497a419e7396d # v1.11.0
       with:
         environment-file: ${{ matrix.os == 'macos-latest' && 'ci/environment-macos.yml' || 'ci/environment.yml' }}
         cache-environment: true
@@ -73,7 +78,7 @@ jobs:
         rm "${WHEEL_PATH}"
 
     - name: Upload wheel artifact
-      uses: actions/upload-artifact@v4.4.0
+      uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
       with:
         name: ml-metadata-wheel-${{ matrix.os }}-py${{ matrix.python-version }}
         path: dist/*.whl
@@ -86,9 +91,11 @@ jobs:
     environment:
       name: pypi
       url: https://pypi.org/p/ml-metadata/
+    permissions:
+      contents: read
     steps:
       - name: Retrieve wheels
-        uses: actions/download-artifact@v4.1.8
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           merge-multiple: true
           path: wheels
@@ -98,7 +105,8 @@ jobs:
           ls -lAs wheels/
 
       - name: Upload to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1.9
+        # zizmor: ignore[use-trusted-publishing]
+        uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # release/v1.9
         with:
           packages_dir: wheels/
           user: __token__
diff --git a/.github/workflows/conda-test.yml b/.github/workflows/conda-test.yml
index 4284fee22..b82e9eb49 100644
--- a/.github/workflows/conda-test.yml
+++ b/.github/workflows/conda-test.yml
@@ -9,6 +9,9 @@ on:
       - master
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ${{ matrix.os }}
@@ -20,10 +23,12 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Setup Micromamba
-      uses: mamba-org/setup-micromamba@v1
+      uses: mamba-org/setup-micromamba@4b9113af4fba0e9e1124b252dd6497a419e7396d # v1.11.0
       with:
         environment-file: ${{ matrix.os == 'macos-latest' && 'ci/environment-macos.yml' || 'ci/environment.yml' }}
         cache-environment: true
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0a1eb0c8e..ed883a314 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -5,10 +5,15 @@ on:
   push:
      branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
-    - uses: pre-commit/action@v3.0.1
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1

From 59127dcac13addba22518b218c8ff86b2719d934 Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 19:06:27 +0000
Subject: [PATCH 02/12] ci: fix Bazel/Bazelisk installation for macOS ARM64
 runners

---
 .github/workflows/conda-build.yml | 17 +++++++++++++----
 .github/workflows/conda-test.yml  | 17 +++++++++++++----
 2 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/conda-build.yml b/.github/workflows/conda-build.yml
index 740c6b55e..6e912701e 100644
--- a/.github/workflows/conda-build.yml
+++ b/.github/workflows/conda-build.yml
@@ -47,13 +47,22 @@ jobs:
       shell: bash -l {0}
       run: |
         # Install Bazelisk (manages Bazel versions)
+        ARCH="amd64"
+        if [ "$(uname -m)" == "arm64" ]; then
+          ARCH="arm64"
+        fi
+
+        mkdir -p "$HOME/.local/bin"
         if [ "$RUNNER_OS" == "Linux" ]; then
-          curl -Lo /tmp/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-linux-amd64
+          curl -Lo "$HOME/.local/bin/bazel" "https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${ARCH}"
         elif [ "$RUNNER_OS" == "macOS" ]; then
-          curl -Lo /tmp/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-darwin-amd64
+          curl -Lo "$HOME/.local/bin/bazel" "https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-darwin-${ARCH}"
+        fi
+        chmod +x "$HOME/.local/bin/bazel"
+        if [ -n "$CONDA_PREFIX" ]; then
+          cp "$HOME/.local/bin/bazel" "$CONDA_PREFIX/bin/bazel"
         fi
-        chmod +x /tmp/bazelisk
-        sudo mv /tmp/bazelisk /usr/local/bin/bazel
+        echo "$HOME/.local/bin" >> $GITHUB_PATH
         echo "USE_BAZEL_VERSION=7.7.0" >> $GITHUB_ENV
         bazel --version
 
diff --git a/.github/workflows/conda-test.yml b/.github/workflows/conda-test.yml
index b82e9eb49..646f2c6fd 100644
--- a/.github/workflows/conda-test.yml
+++ b/.github/workflows/conda-test.yml
@@ -45,13 +45,22 @@ jobs:
       shell: bash -l {0}
       run: |
         # Install Bazelisk (manages Bazel versions)
+        ARCH="amd64"
+        if [ "$(uname -m)" == "arm64" ]; then
+          ARCH="arm64"
+        fi
+
+        mkdir -p "$HOME/.local/bin"
         if [ "$RUNNER_OS" == "Linux" ]; then
-          curl -Lo /tmp/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-linux-amd64
+          curl -Lo "$HOME/.local/bin/bazel" "https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-linux-${ARCH}"
         elif [ "$RUNNER_OS" == "macOS" ]; then
-          curl -Lo /tmp/bazelisk https://github.com/bazelbuild/bazelisk/releases/download/v1.20.0/bazelisk-darwin-amd64
+          curl -Lo "$HOME/.local/bin/bazel" "https://github.com/bazelbuild/bazelisk/releases/download/v1.25.0/bazelisk-darwin-${ARCH}"
+        fi
+        chmod +x "$HOME/.local/bin/bazel"
+        if [ -n "$CONDA_PREFIX" ]; then
+          cp "$HOME/.local/bin/bazel" "$CONDA_PREFIX/bin/bazel"
         fi
-        chmod +x /tmp/bazelisk
-        sudo mv /tmp/bazelisk /usr/local/bin/bazel
+        echo "$HOME/.local/bin" >> $GITHUB_PATH
         echo "USE_BAZEL_VERSION=7.7.0" >> $GITHUB_ENV
         bazel --version
 

From 2d5000dd7fa3fc8dfb081300dc1ae471ecaf2911 Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 19:09:15 +0000
Subject: [PATCH 03/12] ci: upgrade pypa/gh-action-pypi-publish to
 release/v1.12 to fix GHSA-vxmw-7h4f-hqxh

---
 .github/workflows/conda-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/conda-build.yml b/.github/workflows/conda-build.yml
index 6e912701e..06f93351f 100644
--- a/.github/workflows/conda-build.yml
+++ b/.github/workflows/conda-build.yml
@@ -115,7 +115,7 @@ jobs:
 
       - name: Upload to PyPI
         # zizmor: ignore[use-trusted-publishing]
-        uses: pypa/gh-action-pypi-publish@ec4db0b4ddc65acdf4bff5fa45ac92d78b56bdf0 # release/v1.9
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1.12
         with:
           packages_dir: wheels/
           user: __token__

From a9bda59b75a31de944cfb344231fd66dfe640bdb Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 19:16:07 +0000
Subject: [PATCH 04/12] ci: remove conda clang from macOS environment to use
 native Xcode toolchain

---
 ci/environment-macos.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/ci/environment-macos.yml b/ci/environment-macos.yml
index 1e6ef593e..fc138c5ee 100644
--- a/ci/environment-macos.yml
+++ b/ci/environment-macos.yml
@@ -14,9 +14,5 @@ dependencies:
   - six  # Required by ZetaSQL build tools
   - libiconv  # Required by libmysqlclient for character encoding conversions
 
-  # C/C++ compilers
-  - clang
-  - clangxx
-
   - pip:
     - delocate  # For macOS wheel repair

From 0e338fd8376badca1575ee3b28dabc727b8296a5 Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 19:19:04 +0000
Subject: [PATCH 05/12] ci: update pypa/gh-action-pypi-publish to latest
 release v1.14.2

---
 .github/workflows/conda-build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/conda-build.yml b/.github/workflows/conda-build.yml
index 06f93351f..a045f4a16 100644
--- a/.github/workflows/conda-build.yml
+++ b/.github/workflows/conda-build.yml
@@ -115,7 +115,7 @@ jobs:
 
       - name: Upload to PyPI
         # zizmor: ignore[use-trusted-publishing]
-        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # release/v1.12
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
         with:
           packages_dir: wheels/
           user: __token__

From 273b4f2212efb7aa8e247b2e5174e33688f4bf2f Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 19:24:22 +0000
Subject: [PATCH 06/12] build: unset conda
 APPLE_SDK_VERSION_OVERRIDE/XCODE_VERSION_OVERRIDE on macOS to fix Bazel
 target SDK

---
 .github/workflows/conda-build.yml | 1 +
 .github/workflows/conda-test.yml  | 1 +
 setup.py                          | 4 ++++
 3 files changed, 6 insertions(+)

diff --git a/.github/workflows/conda-build.yml b/.github/workflows/conda-build.yml
index a045f4a16..6f7f4c8fe 100644
--- a/.github/workflows/conda-build.yml
+++ b/.github/workflows/conda-build.yml
@@ -74,6 +74,7 @@ jobs:
     - name: Build the package
       shell: bash -l {0}
       run: |
+        unset APPLE_SDK_VERSION_OVERRIDE XCODE_VERSION_OVERRIDE
         rm -rf build build_mlmd_tmp dist
         python -m build --wheel --no-isolation
 
diff --git a/.github/workflows/conda-test.yml b/.github/workflows/conda-test.yml
index 646f2c6fd..99c10de3d 100644
--- a/.github/workflows/conda-test.yml
+++ b/.github/workflows/conda-test.yml
@@ -67,6 +67,7 @@ jobs:
     - name: Build the package
       shell: bash -l {0}
       run: |
+        unset APPLE_SDK_VERSION_OVERRIDE XCODE_VERSION_OVERRIDE
         rm -rf build build_mlmd_tmp dist
         python setup.py bdist_wheel
 
diff --git a/setup.py b/setup.py
index f2e809278..e0cd718dd 100644
--- a/setup.py
+++ b/setup.py
@@ -103,6 +103,10 @@ def finalize_options(self):
       else:
         self._additional_build_options = ['--macos_minimum_os=10.14']
 
+      # Remove any overrides from conda environment that break Bazel on macOS
+      os.environ.pop('APPLE_SDK_VERSION_OVERRIDE', None)
+      os.environ.pop('XCODE_VERSION_OVERRIDE', None)
+
       if 'ICONV_LIBRARIES' in os.environ:
         self._additional_build_options.append(
             '--action_env=CMAKE_ICONV_FLAG=-DICONV_LIBRARIES=' +

From e3cc1a433abeff425243daae300660c36b128b36 Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 19:31:29 +0000
Subject: [PATCH 07/12] build: configure BAZEL_USE_CPP_ONLY_TOOLCHAIN=1 on
 macOS to bypass wrapped_clang

---
 .bazelrc                          | 2 ++
 .github/workflows/conda-build.yml | 1 +
 .github/workflows/conda-test.yml  | 1 +
 setup.py                          | 7 +++++--
 4 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/.bazelrc b/.bazelrc
index baf91fc72..17a6d839d 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -29,7 +29,9 @@ build --protocopt=--experimental_allow_proto3_optional
 build --incompatible_require_linker_input_cc_api=false
 
 build:macos --apple_platform_type=macos
+build:macos --repo_env=BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
 build:macos_arm64 --cpu=darwin_arm64
+build:macos_arm64 --repo_env=BAZEL_USE_CPP_ONLY_TOOLCHAIN=1
 build:macos_arm64 --linkopt=-Wl,-undefined,dynamic_lookup
 build:macos_arm64 --host_linkopt=-Wl,-undefined,dynamic_lookup
 build --conlyopt=-std=c11
diff --git a/.github/workflows/conda-build.yml b/.github/workflows/conda-build.yml
index 6f7f4c8fe..ede6e6780 100644
--- a/.github/workflows/conda-build.yml
+++ b/.github/workflows/conda-build.yml
@@ -64,6 +64,7 @@ jobs:
         fi
         echo "$HOME/.local/bin" >> $GITHUB_PATH
         echo "USE_BAZEL_VERSION=7.7.0" >> $GITHUB_ENV
+        echo "BAZEL_USE_CPP_ONLY_TOOLCHAIN=1" >> $GITHUB_ENV
         bazel --version
 
     - name: Install build tooling
diff --git a/.github/workflows/conda-test.yml b/.github/workflows/conda-test.yml
index 99c10de3d..ec2b98ae7 100644
--- a/.github/workflows/conda-test.yml
+++ b/.github/workflows/conda-test.yml
@@ -62,6 +62,7 @@ jobs:
         fi
         echo "$HOME/.local/bin" >> $GITHUB_PATH
         echo "USE_BAZEL_VERSION=7.7.0" >> $GITHUB_ENV
+        echo "BAZEL_USE_CPP_ONLY_TOOLCHAIN=1" >> $GITHUB_ENV
         bazel --version
 
     - name: Build the package
diff --git a/setup.py b/setup.py
index e0cd718dd..e0e66e9e2 100644
--- a/setup.py
+++ b/setup.py
@@ -99,13 +99,16 @@ def finalize_options(self):
       # This flag determines the platform qualifier of the macos wheel.
       if platform.machine() == 'arm64':
         self._additional_build_options = ['--macos_minimum_os=11.0',
-                                          '--config=macos_arm64']
+                                          '--config=macos_arm64',
+                                          '--repo_env=BAZEL_USE_CPP_ONLY_TOOLCHAIN=1']
       else:
-        self._additional_build_options = ['--macos_minimum_os=10.14']
+        self._additional_build_options = ['--macos_minimum_os=10.14',
+                                          '--repo_env=BAZEL_USE_CPP_ONLY_TOOLCHAIN=1']
 
       # Remove any overrides from conda environment that break Bazel on macOS
       os.environ.pop('APPLE_SDK_VERSION_OVERRIDE', None)
       os.environ.pop('XCODE_VERSION_OVERRIDE', None)
+      os.environ['BAZEL_USE_CPP_ONLY_TOOLCHAIN'] = '1'
 
       if 'ICONV_LIBRARIES' in os.environ:
         self._additional_build_options.append(

From 3de6ce878a07354586211a334e2bf9f2955a9d4b Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 20:24:54 +0000
Subject: [PATCH 08/12] ci: separate doc check into ci-docs.yml (read-only) and
 deploy into cd-docs.yml (push-only)

---
 .github/workflows/cd-docs.yml |  7 +-----
 .github/workflows/ci-docs.yml | 46 +++++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 6 deletions(-)
 create mode 100644 .github/workflows/ci-docs.yml

diff --git a/.github/workflows/cd-docs.yml b/.github/workflows/cd-docs.yml
index e9d29de1a..6d1ee1662 100644
--- a/.github/workflows/cd-docs.yml
+++ b/.github/workflows/cd-docs.yml
@@ -4,7 +4,6 @@ on:
   push:
     branches:
       - 'master'
-  pull_request:
 
 permissions:
   contents: write
@@ -25,6 +24,7 @@ jobs:
           cache: 'pip'
           cache-dependency-path: |
             setup.py
+            requirements-docs.txt
 
       - name: Save time for cache for mkdocs
         run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
@@ -41,12 +41,7 @@ jobs:
         run: pip install -r requirements-docs.txt
 
       - name: Deploy to GitHub Pages
-        if: (github.event_name != 'pull_request')
         run: |
           git config user.name github-actions[bot]
           git config user.email 41898282+github-actions[bot]@users.noreply.github.com
           mkdocs gh-deploy --force
-
-      - name: Build docs to check for errors
-        run: mkdocs build
-        if: (github.event_name == 'pull_request')
diff --git a/.github/workflows/ci-docs.yml b/.github/workflows/ci-docs.yml
new file mode 100644
index 000000000..2de9c3caa
--- /dev/null
+++ b/.github/workflows/ci-docs.yml
@@ -0,0 +1,46 @@
+name: ci-docs
+
+on:
+  pull_request:
+    branches:
+      - 'master'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+          cache-dependency-path: |
+            setup.py
+            requirements-docs.txt
+
+      - name: Save time for cache for mkdocs
+        run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
+
+      - name: Caching
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+        with:
+          key: mkdocs-material-${{ env.cache_id }}
+          path: .cache
+          restore-keys: |
+            mkdocs-material-
+
+      - name: Install Dependencies
+        run: pip install -r requirements-docs.txt
+
+      - name: Build docs to check for errors
+        run: mkdocs build

From 72589cb48ccb58592ea16c7d51e9b393d5b90763 Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 20:27:57 +0000
Subject: [PATCH 09/12] ci: suppress excessive-permissions check with
 justification for docs deploy

---
 .github/workflows/cd-docs.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/cd-docs.yml b/.github/workflows/cd-docs.yml
index 6d1ee1662..cd46d55dd 100644
--- a/.github/workflows/cd-docs.yml
+++ b/.github/workflows/cd-docs.yml
@@ -5,12 +5,18 @@ on:
     branches:
       - 'master'
 
+# zizmor: ignore[excessive-permissions]
 permissions:
+  # Required to deploy documentation to GitHub Pages (gh-pages branch)
   contents: write
 
 jobs:
   deploy:
     runs-on: ubuntu-latest
+    # zizmor: ignore[excessive-permissions]
+    permissions:
+      # Required to deploy documentation to GitHub Pages (gh-pages branch)
+      contents: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

From aad83a2775003712cf22d5a161defc04fbaa21e0 Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 20:33:12 +0000
Subject: [PATCH 10/12] ci: consolidate documentation check and deployment into
 cd-docs.yml

---
 .github/workflows/cd-docs.yml | 45 +++++++++++++++++++++++++++++++---
 .github/workflows/ci-docs.yml | 46 -----------------------------------
 2 files changed, 42 insertions(+), 49 deletions(-)
 delete mode 100644 .github/workflows/ci-docs.yml

diff --git a/.github/workflows/cd-docs.yml b/.github/workflows/cd-docs.yml
index cd46d55dd..43de24ae8 100644
--- a/.github/workflows/cd-docs.yml
+++ b/.github/workflows/cd-docs.yml
@@ -4,14 +4,53 @@ on:
   push:
     branches:
       - 'master'
+  pull_request:
 
-# zizmor: ignore[excessive-permissions]
 permissions:
-  # Required to deploy documentation to GitHub Pages (gh-pages branch)
-  contents: write
+  contents: read
 
 jobs:
+  build-check:
+    name: Build docs check
+    if: (github.event_name == 'pull_request')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+          cache-dependency-path: |
+            setup.py
+            requirements-docs.txt
+
+      - name: Save time for cache for mkdocs
+        run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
+
+      - name: Caching
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+        with:
+          key: mkdocs-material-${{ env.cache_id }}
+          path: .cache
+          restore-keys: |
+            mkdocs-material-
+
+      - name: Install Dependencies
+        run: pip install -r requirements-docs.txt
+
+      - name: Build docs to check for errors
+        run: mkdocs build
+
   deploy:
+    name: Deploy to GitHub Pages
+    if: (github.event_name != 'pull_request')
     runs-on: ubuntu-latest
     # zizmor: ignore[excessive-permissions]
     permissions:
diff --git a/.github/workflows/ci-docs.yml b/.github/workflows/ci-docs.yml
deleted file mode 100644
index 2de9c3caa..000000000
--- a/.github/workflows/ci-docs.yml
+++ /dev/null
@@ -1,46 +0,0 @@
-name: ci-docs
-
-on:
-  pull_request:
-    branches:
-      - 'master'
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
-        with:
-          python-version: '3.12'
-          cache: 'pip'
-          cache-dependency-path: |
-            setup.py
-            requirements-docs.txt
-
-      - name: Save time for cache for mkdocs
-        run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-
-      - name: Caching
-        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
-        with:
-          key: mkdocs-material-${{ env.cache_id }}
-          path: .cache
-          restore-keys: |
-            mkdocs-material-
-
-      - name: Install Dependencies
-        run: pip install -r requirements-docs.txt
-
-      - name: Build docs to check for errors
-        run: mkdocs build

From 91c019e976f6331f39f84d45968aa7a7436e10fe Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 20:44:38 +0000
Subject: [PATCH 11/12] ci: eliminate PR write permissions by making
 ci-docs.yml strictly read-only and cd-docs.yml push-only

---
 .github/workflows/cd-docs.yml | 44 +++-----------------------------
 .github/workflows/ci-docs.yml | 47 +++++++++++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 41 deletions(-)
 create mode 100644 .github/workflows/ci-docs.yml

diff --git a/.github/workflows/cd-docs.yml b/.github/workflows/cd-docs.yml
index 43de24ae8..cac5e85e7 100644
--- a/.github/workflows/cd-docs.yml
+++ b/.github/workflows/cd-docs.yml
@@ -4,53 +4,15 @@ on:
   push:
     branches:
       - 'master'
-  pull_request:
 
+# zizmor: ignore[excessive-permissions]
 permissions:
-  contents: read
+  # Required to deploy documentation to GitHub Pages (gh-pages branch)
+  contents: write
 
 jobs:
-  build-check:
-    name: Build docs check
-    if: (github.event_name == 'pull_request')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout repo
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Python 3.12
-        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
-        with:
-          python-version: '3.12'
-          cache: 'pip'
-          cache-dependency-path: |
-            setup.py
-            requirements-docs.txt
-
-      - name: Save time for cache for mkdocs
-        run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
-
-      - name: Caching
-        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
-        with:
-          key: mkdocs-material-${{ env.cache_id }}
-          path: .cache
-          restore-keys: |
-            mkdocs-material-
-
-      - name: Install Dependencies
-        run: pip install -r requirements-docs.txt
-
-      - name: Build docs to check for errors
-        run: mkdocs build
-
   deploy:
     name: Deploy to GitHub Pages
-    if: (github.event_name != 'pull_request')
     runs-on: ubuntu-latest
     # zizmor: ignore[excessive-permissions]
     permissions:
diff --git a/.github/workflows/ci-docs.yml b/.github/workflows/ci-docs.yml
new file mode 100644
index 000000000..00753c820
--- /dev/null
+++ b/.github/workflows/ci-docs.yml
@@ -0,0 +1,47 @@
+name: Check docs
+
+on:
+  pull_request:
+    branches:
+      - 'master'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build docs check
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
+        with:
+          python-version: '3.12'
+          cache: 'pip'
+          cache-dependency-path: |
+            setup.py
+            requirements-docs.txt
+
+      - name: Save time for cache for mkdocs
+        run: echo "cache_id=$(date --utc '+%V')" >> $GITHUB_ENV
+
+      - name: Caching
+        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
+        with:
+          key: mkdocs-material-${{ env.cache_id }}
+          path: .cache
+          restore-keys: |
+            mkdocs-material-
+
+      - name: Install Dependencies
+        run: pip install -r requirements-docs.txt
+
+      - name: Build docs to check for errors
+        run: mkdocs build

From 81400e6c38f1b610b1ba0f479bacb79f4cde3b2e Mon Sep 17 00:00:00 2001
From: Venkata Sai Madhur Karampudi <vkarampudi@google.com>
Date: Thu, 13 Aug 2026 20:47:20 +0000
Subject: [PATCH 12/12] ci: set top-level permissions to contents: read in
 cd-docs.yml

---
 .github/workflows/cd-docs.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/cd-docs.yml b/.github/workflows/cd-docs.yml
index cac5e85e7..0c6f0428e 100644
--- a/.github/workflows/cd-docs.yml
+++ b/.github/workflows/cd-docs.yml
@@ -5,10 +5,8 @@ on:
     branches:
       - 'master'
 
-# zizmor: ignore[excessive-permissions]
 permissions:
-  # Required to deploy documentation to GitHub Pages (gh-pages branch)
-  contents: write
+  contents: read
 
 jobs:
   deploy: