Fix Actions issues

[morganchen12]

Fixed all high priority zizmor findings and a few other medium priority ones. This PR is broken out into commits that describe which actions were fixed. The ratchet diff can be ignored entirely since that should be a no-op for your tests. If any of these changes break workflows, it would most likely be the permission changes.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[github-actions]

Integration test with FLAKINESS (succeeded after retry)

Requested by @a-maurice on commit 18eb5db
Last updated: Mon Jun 15 13:34 PDT 2026
View integration test log & download artifacts

Failures	Configs
app_check	[TEST] [FLAKINESS] [Android] [1/3 os: macos] [1/2 android_device: emulator_ftl_target] (1 failed tests)   CRASH/TIMEOUT [TEST] [FLAKINESS] [Android] [1/3 os: ubuntu] [1/2 android_device: android_target] (2 failed tests)   FirebaseAppCheckTest.TestDebugProviderValidLimitedUseToken   FirebaseAppCheckTest.TestDebugProviderValidToken
database	[TEST] [FLAKINESS] [Android] [1/3 os: windows] [1/2 android_device: emulator_ftl_target] (1 failed tests)   CRASH/TIMEOUT
firestore	[TEST] [FLAKINESS] [Android] [1/3 os: macos] [1/2 android_device: android_target] (1 failed tests)   CRASH/TIMEOUT [TEST] [FLAKINESS] [iOS] [macos] [1/2 ios_device: ios_target] (1 failed tests)   CRASH/TIMEOUT
installations	[TEST] [FLAKINESS] [Android] [1/3 os: macos] [1/2 android_device: emulator_ftl_target] (1 failed tests)   CRASH/TIMEOUT
remote_config	[TEST] [FLAKINESS] [Android] [1/3 os: macos] [1/2 android_device: emulator_ftl_target] (1 failed tests)   CRASH/TIMEOUT [TEST] [FLAKINESS] [Android] [1/3 os: ubuntu] [1/2 android_device: android_target] (1 failed tests)   FirebaseRemoteConfigTest.TestAddOnConfigUpdateListener

Add flaky tests to go/fpl-cpp-flake-tracker