fix(ci): harden GitHub Actions workflows (#14789)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #14789.

Warning

This changes when the workflow runs. Triggers or workflow-level settings were rewritten in .github/workflows/pr_labeler.yml. A pull_request_target rewritten to pull_request is the correct fix for the finding and also drops the job's access to secrets — confirm that is what you want before merging.

Targets dependabot/github_actions/actions-ca6b5df6ad. Files changed, and what changed them:

• .github/workflows/claude_review.yml — action pins
• .github/workflows/issue_labeler.yml — llm injection
• .github/workflows/pr_labeler.yml — dangerous trigger
• .github/workflows/pypi_publish.yaml — action pins
• .github/workflows/trufflehog.yml — action pins

Fixed by this PR:

• HIGH unpinned-action (pinact) — .github/workflows/claude_review.yml:39
• HIGH llm_prompt_injection (claude) — .github/workflows/issue_labeler.yml
• HIGH dangerous-triggers (zizmor) — .github/workflows/pr_labeler.yml:3
• HIGH unpinned-action (pinact) — .github/workflows/pypi_publish.yaml:77
• HIGH unpinned-action (pinact) — .github/workflows/trufflehog.yml:20

This does not fix everything. 43 further finding(s) (39 high, 4 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/bot_pytest.yml

job	granted	why
gate	issues: write, pull-requests: write	The 'Acknowledge with 👀' step POSTs to repos/.../issues/comments/{id}/reactions and 'Post "running" comment' POSTs to repos/.../issues/{n}/comments; these are issue-comment writes on a PR, so both issues: write and pull-requests: write are listed since the comment lives on a pull request thread (reviewer may drop one after confirming which suffices).
gpu	contents: read	Only actions/checkout of the PR head needs the token; upload-artifact within the same run and the pytest/dependency steps need no scopes, and the container image is pulled from Docker Hub rather than GHCR.
report	issues: write, pull-requests: write	The 'Update comment with final status' step does gh api -X PATCH repos/.../issues/comments/{id}, an issue-comment edit on a PR thread, hence issues: write plus pull-requests: write.

.github/workflows/codeql.yml

codeql was left as it is — This job only calls the external reusable workflow huggingface/security-workflows@e0d40aa, whose steps are not in this file; its declared set (security-events: write, packages: read, actions: read, contents: read) matches a typical CodeQL analyze-and-upload job, but a reviewer should confirm against the pinned reusable workflow.

.github/workflows/pr_link_issue_reminder.yml

remind was left as it is — The only token-consuming step runs python utils/remind_link_issue.py, a script that is not in this file, so its actual API calls cannot be verified; from the job comment it appears to comment on PRs, add/read labels and close PRs (which would suggest contents: read for checkout plus pull-requests: write and possibly issues: write), but a reviewer should read the script to confirm before narrowing the existing permissions block.

.github/workflows/stale.yml

job	granted	why
close_stale_issues	contents: read, issues: write, pull-requests: write	actions/checkout needs contents: read, and the final step runs python utils/stale.py with PyGithub against GITHUB_TOKEN to comment on/close stale issues and PRs, which needs issues: write and pull-requests: write; the script body is not in this file, so a reviewer should confirm utils/stale.py does not also push commits or touch other APIs.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.