Clean up workflow files from Zizmor output

[mandreko-bitwarden]

🎟️ Tracking

https://bitwarden.atlassian.net/browse/VULN-285

📔 Objective

Perform cleanup of existing workflows to be in compliance with Zizmor and bwwl.

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[Copilot]

Pull Request Overview

This PR performs cleanup of GitHub workflow files to comply with Zizmor and bwwl security linting requirements. The changes primarily focus on improving security by explicitly setting credential persistence settings, adding proper environment variable quoting, and standardizing string formatting.

• Adds explicit persist-credentials configurations to checkout actions for better security control
• Updates variable references to use proper shell quoting and environment variable syntax
• Standardizes string quoting for consistency across workflow files

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/ci.yml	Adds persist-credentials: false to checkout action for security
.github/workflows/cd.yml	Updates quoting, adds credential settings, and improves variable handling
.github/workflows/bwwl_operations.yml	Fixes shell variable quoting and adds explicit credential persistence

[github-actions]

Checkmarx One – Scan Summary & Details – df5945a7-e38c-45e7-a058-d7b22fbc47a0

Great job! No new security vulnerabilities introduced in this pull request