Initial workflows static analysis fixes

.github/workflows/IO_Iceberg_Integration_Tests.yml

@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Integration Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -75,4 +77,4 @@ jobs:
       - name: Run IcebergIO Integration Test
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:java:io:iceberg:integrationTest --info
+          gradle-command: :sdks:java:io:iceberg:integrationTest --info

.github/workflows/IO_Iceberg_Integration_Tests_Dataflow.yml

@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Integration Tests on Dataflow"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -75,4 +77,4 @@ jobs:
       - name: Run IcebergIO Integration Tests on Dataflow
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:java:io:iceberg:dataflowIntegrationTest --info
+          gradle-command: :sdks:java:io:iceberg:dataflowIntegrationTest --info

.github/workflows/IO_Iceberg_Managed_Integration_Tests_Dataflow.yml

@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Managed Integration Tests on Dataflow"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -78,4 +80,4 @@ jobs:
           gradle-command: :sdks:java:io:iceberg:dataflowIntegrationTest
           arguments: |
             --info \
-            -PenableManagedTransforms
+            -PenableManagedTransforms

.github/workflows/IO_Iceberg_Performance_Tests.yml

@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run IcebergIO Performance Test"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -75,4 +77,4 @@ jobs:
       - name: Run IcebergIO Performance Test
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:java:io:iceberg:loadTest
+          gradle-command: :sdks:java:io:iceberg:loadTest

.github/workflows/IO_Iceberg_Unit_Tests.yml

@@ -83,6 +83,8 @@ jobs:
     runs-on: [self-hosted, ubuntu-24.04, main]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/assign_milestone.yml

@@ -34,6 +34,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 2
+          persist-credentials: false
 
       - uses: actions/github-script@v9
         with:

.github/workflows/beam_CancelStaleDataflowJobs.yml

@@ -63,6 +63,8 @@ jobs:
       github.event.comment.body == 'Run Cancel Stale Dataflow Jobs'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/beam_CleanUpDataprocResources.yml

@@ -56,6 +56,8 @@ jobs:
     name: "beam_CleanUpDataprocResources"
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Delete leaked resources for all the jobs that generates flink clusters
         run: |
-          cd ${{ github.workspace }}/.test-infra/dataproc; ./cleanup.sh -xe
+          cd ${{ github.workspace }}/.test-infra/dataproc; ./cleanup.sh -xe

.github/workflows/beam_CleanUpGCPResources.yml

@@ -63,6 +63,8 @@ jobs:
       github.event.comment.body == 'Run Clean GCP Resources'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/beam_CleanUpPrebuiltSDKImages.yml

@@ -63,6 +63,8 @@ jobs:
       github.event.comment.body == 'Run Clean Prebuilt Images'
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -80,4 +82,4 @@ jobs:
       - name: run remove stale sdk container images
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :beam-test-tools:removeStaleSDKContainerImages
+          gradle-command: :beam-test-tools:removeStaleSDKContainerImages

.github/workflows/beam_CloudML_Benchmarks_Dataflow.yml

@@ -64,6 +64,8 @@ jobs:
         job_phrase: ["Run TFT Criteo Benchmarks"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/beam_IODatastoresCredentialsRotation.yml

@@ -60,6 +60,8 @@ jobs:
         job_phrase: ["N/A"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/beam_Inference_Python_Benchmarks_Dataflow.yml

@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Inference Benchmarks"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -238,4 +240,4 @@ jobs:
             -PpythonVersion=3.10 \
             -PbeamPythonExtra=ml_test \
             -PloadTest.requirementsTxtFile=apache_beam/ml/transforms/mltransform_tests_requirements.txt \
-            '-PloadTest.args=${{ env.beam_Inference_Python_Benchmarks_Dataflow_test_arguments_12 }} --autoscaling_algorithm=NONE --metrics_table=mltransform_one_hot_encoding_batch --influx_measurement=mltransform_one_hot_encoding_batch --job_name=benchmark-tests-mltransform-one-hot-encoding-batch-${{env.NOW_UTC}} --output_file=gs://temp-storage-for-end-to-end-tests/mltransform/one_hot_output_${{env.NOW_UTC}} --artifact_location=gs://temp-storage-for-end-to-end-tests/mltransform/artifacts_${{env.NOW_UTC}}'
+            '-PloadTest.args=${{ env.beam_Inference_Python_Benchmarks_Dataflow_test_arguments_12 }} --autoscaling_algorithm=NONE --metrics_table=mltransform_one_hot_encoding_batch --influx_measurement=mltransform_one_hot_encoding_batch --job_name=benchmark-tests-mltransform-one-hot-encoding-batch-${{env.NOW_UTC}} --output_file=gs://temp-storage-for-end-to-end-tests/mltransform/one_hot_output_${{env.NOW_UTC}} --artifact_location=gs://temp-storage-for-end-to-end-tests/mltransform/artifacts_${{env.NOW_UTC}}'

.github/workflows/beam_Infrastructure_PolicyEnforcer.yml

@@ -43,6 +43,8 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Setup Python
         uses: actions/setup-python@v4

.github/workflows/beam_Infrastructure_SecurityLogging.yml

@@ -45,6 +45,8 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
 
       - name: Setup Python
         uses: actions/setup-python@v4

.github/workflows/beam_Infrastructure_ServiceAccountKeys.yml

@@ -49,6 +49,8 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup gcloud
         uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
 

.github/workflows/beam_Infrastructure_UsersPermissions.yml

@@ -48,6 +48,7 @@ jobs:
         uses: actions/checkout@v7
         with:
           ref: ${{ github.event.pull_request.merged == true && github.base_ref || github.event.pull_request.head.sha }}
+          persist-credentials: false
       - name: Setup gcloud
         uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db
       - name: Install Terraform

.github/workflows/beam_Java_JMH.yml

@@ -63,6 +63,8 @@ jobs:
     name: "beam_Java_JMH"
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup environment
         uses: ./.github/actions/setup-environment-action
       - name: run the Java JMH micro-benchmark harness suite
@@ -72,4 +74,4 @@ jobs:
       - name: run the Java JMH micro-benchmark core suite
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
-          gradle-command: :sdks:java:core:jmh:jmh
+          gradle-command: :sdks:java:core:jmh:jmh

.github/workflows/beam_Java_LoadTests_Combine_Smoke.yml

@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Java Load Tests Combine Smoke"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -104,4 +106,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.CombineLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_Java_LoadTests_Combine_Smoke_test_arguments_3 }}'
+            '-PloadTest.args=${{ env.beam_Java_LoadTests_Combine_Smoke_test_arguments_3 }}'

.github/workflows/beam_LoadTests_Go_CoGBK_Dataflow_Batch.yml

@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Go CoGBK Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -114,4 +116,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=cogbk \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{ env.beam_LoadTests_Go_CoGBK_Dataflow_Batch_test_arguments_4 }}'
+            '-PloadTest.args=${{ env.beam_LoadTests_Go_CoGBK_Dataflow_Batch_test_arguments_4 }}'

.github/workflows/beam_LoadTests_Go_CoGBK_Flink_batch.yml

@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Go CoGBK Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/beam_LoadTests_Go_Combine_Dataflow_Batch.yml

@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Go Combine Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -106,4 +108,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=combine \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{ env.beam_LoadTests_Go_Combine_Dataflow_Batch_test_arguments_3 }} --job_name=load-tests-go-dataflow-batch-combine-3-${{env.NOW_UTC}}'
+            '-PloadTest.args=${{ env.beam_LoadTests_Go_Combine_Dataflow_Batch_test_arguments_3 }} --job_name=load-tests-go-dataflow-batch-combine-3-${{env.NOW_UTC}}'

.github/workflows/beam_LoadTests_Go_Combine_Flink_Batch.yml

@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Go Combine Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/beam_LoadTests_Go_GBK_Dataflow_Batch.yml

@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Go GBK Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -142,4 +144,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=group_by_key \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{ env.beam_LoadTests_Go_GBK_Dataflow_Batch_test_arguments_7 }} --job_name=load-tests-go-dataflow-batch-gbk-7-${{env.NOW_UTC}}'
+            '-PloadTest.args=${{ env.beam_LoadTests_Go_GBK_Dataflow_Batch_test_arguments_7 }} --job_name=load-tests-go-dataflow-batch-gbk-7-${{env.NOW_UTC}}'

.github/workflows/beam_LoadTests_Go_GBK_Flink_Batch.yml

@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Go GBK Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/beam_LoadTests_Go_ParDo_Dataflow_Batch.yml

@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Go ParDo Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -114,4 +116,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=pardo \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{ env.beam_LoadTests_Go_ParDo_Dataflow_Batch_test_arguments_4 }}'
+            '-PloadTest.args=${{ env.beam_LoadTests_Go_ParDo_Dataflow_Batch_test_arguments_4 }}'

.github/workflows/beam_LoadTests_Go_ParDo_Flink_Batch.yml

@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Go ParDo Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/beam_LoadTests_Go_SideInput_Dataflow_Batch.yml

@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Go SideInput Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -96,4 +98,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=sideinput \
             -Prunner=DataflowRunner \
-            '-PloadTest.args=${{ env.beam_LoadTests_Go_SideInput_Dataflow_Batch_test_arguments_2 }}'
+            '-PloadTest.args=${{ env.beam_LoadTests_Go_SideInput_Dataflow_Batch_test_arguments_2 }}'

.github/workflows/beam_LoadTests_Go_SideInput_Flink_Batch.yml

@@ -73,6 +73,8 @@ jobs:
         job_phrase: ["Run Load Tests Go SideInput Flink Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:

.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_Batch.yml

@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java CoGBK Dataflow Batch"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -113,4 +115,4 @@ jobs:
           arguments: |
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.CoGroupByKeyLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_Dataflow_Batch_test_arguments_4 }} --appName=load_tests_Java_Dataflow_batch_CoGBK_4'
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_Dataflow_Batch_test_arguments_4 }} --appName=load_tests_Java_Dataflow_batch_CoGBK_4'

.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_Streaming.yml

@@ -63,6 +63,8 @@ jobs:
         job_phrase: ["Run Load Tests Java CoGBK Dataflow Streaming"]
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -125,4 +127,4 @@ jobs:
         if: always()
         with:
           files: '**/build/test-results/**/*.xml'
-          large_files: true
+          large_files: true

.github/workflows/beam_LoadTests_Java_CoGBK_Dataflow_V2_Batch_JavaVersions.yml

@@ -67,6 +67,8 @@ jobs:
         java_version: ['11','17']
     steps:
       - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
       - name: Setup repository
         uses: ./.github/actions/setup-action
         with:
@@ -129,4 +131,4 @@ jobs:
             -Pjava${{ matrix.java_version }}Home=$JAVA_HOME_${{ matrix.java_version }}_X64 \
             -PloadTest.mainClass=org.apache.beam.sdk.loadtests.CoGroupByKeyLoadTest \
             -Prunner=:runners:google-cloud-dataflow-java \
-            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_Dataflow_V2_Batch_JavaVersions_test_arguments_4 }} --appName=load_tests_Java${{ matrix.java_version }}_Dataflow_V2_batch_CoGBK_4'
+            '-PloadTest.args=${{ env.beam_LoadTests_Java_CoGBK_Dataflow_V2_Batch_JavaVersions_test_arguments_4 }} --appName=load_tests_Java${{ matrix.java_version }}_Dataflow_V2_batch_CoGBK_4'