Pin and modernize GitHub Actions references

[jar-stripe]

Remediates 21 high-severity zizmor findings across publish.yml, release.yml, and sync-openapi-artifacts.yml.

Rather than only hash-pinning, this also upgrades the end-of-life actions the pins would otherwise freeze in place, and replaces the archived tibdex/github-app-token. Commits are ordered so the reported findings come first and everything beyond them is separable — any of the later commits can be dropped without touching the remediation.

Behavior changes, called out individually

These are the parts that are not mechanical. None of the three files has PR CI, so review carries the weight here.

• tibdex/github-app-token → actions/create-github-app-token@v3, 5 sites. Upstream is archived (last release 2023). app_id/private_key become app-id/private-key; the token output name is unchanged, so nothing downstream moves, and no new secret or variable is needed. Each of the 5 tokens is scoped to the repositories and permissions its own consumers need — the new action otherwise requests the installation's full permission set, which is itself a high-severity finding.
• softprops/action-gh-release is gone, replaced by gh release in a script step. zizmor flags the action as superfluous, and removing it drops a third-party action from the release path entirely. The script mirrors the action's create-or-update behavior, so re-running on an existing tag still overwrites the notes instead of failing.
• release.yml now refuses to run from a non-tag ref. This restores a guard that came free with the removed action: it threw GitHub Releases requires a tag when dispatched from a branch, whereas gh release create would create the release and cut a tag named after the branch.
• peter-evans/create-pull-request v6 → v8 and actions/checkout → v7. v7 renamed git-token to branch-token; we pass neither, so nothing changes here.
• The merge mode in actions/enable-auto-merge is now a typed GraphQL variable, not text pasted into the query. The server validates it against the PullRequestMergeMethod enum, so it cannot carry query syntax at all.

Beyond the reported 21

The scan covered .github/workflows/ only, so it never reached the composite actions under actions/, which all 7 SDK repos invoke on every CI run. They held 25 more high-severity findings (21 template-injection, 4 unpinned-uses), fixed here.

Also fixed: artipacked (persisted checkout credentials), archived-uses, excessive-permissions on release.yml, and the github-app findings introduced by the token swap.

One deliberate exception

sync-openapi-artifacts.yml's checkout keeps its persisted credential, because the workflow's last step is a plain git push that needs it. The artipacked finding is about that credential escaping through an uploaded artifact; this workflow uploads none, and the push is the final step. It is low severity, below the CI gate, so no zizmor.yml ignore entry is needed.

Verification

zizmor --min-severity=high .   ->  No findings to report
zizmor .                       ->  1 low (the exception above), 0 medium, 0 high

Every pin was checked against the tag its comment claims, and each resolves to a commit rather than a tag object — openapi's tags are annotated, so refs/tags/v2407 is a tag object and would not work as a pin.

The composite actions were also validated from a consumer, since nothing here exercises them: a scratch branch on stripe-ruby pointed actions/stripe-mock at this branch and passed on all three input paths any real caller uses — no inputs (what all 7 SDK repos do), beta, and spec_path/fixtures. The openapi_version path fails, but it fails identically at master: it builds a host path and hands it to a container that only mounts the workspace, so it has been broken for any Linux runner independently of this PR.

The last commit adds zizmor to CI at --min-severity=high, matching the threshold these findings were reported at. Here the action's default whole-repository scope is a feature: it covers actions/, which the original scan never reached.

Before merging

The repo's Actions allowlist has to be widened first, or this breaks at startup. patterns_allowed entries whose ref is version-shaped (@v6) cannot match a hex SHA, so a pinned action the allowlist only admits as @v6 makes the workflow fail to start. Needed:

entry	change
peter-evans/create-pull-request@v4, @v6	→ one peter-evans/create-pull-request@*
slackapi/slack-github-action@v1.23.0	→ @*
zizmorcore/zizmor-action	add @* — new; without it the CI check here cannot start

tibdex/github-app-token@v1/@v1.5.2 and softprops/action-gh-release@v1 become unused once this merges and can be dropped afterward — not before, since master still references them. (ruby/setup-ruby@v1 is already stale; nothing in the repo uses it.)

stripe/openapi needs no entry: the only full-path self-reference is notify-release → notify-slack, and notify-release is invoked from the SDK repos and stripe-mock, whose allowlists already carry stripe/openapi@*.

Follow-up, not in this PR

actions/notify-release pins notify-slack at master's current tip (325f3b15, v2407), which is the pre-pin copy. Once this merges it should be re-pinned to a commit that contains these fixes.