fix(ci): harden GitHub Actions workflows (#14789)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #14789.

Targets dependabot/github_actions/actions-ca6b5df6ad. Files changed, and what changed them:

• .github/workflows/claude_review.yml — action pins
• .github/workflows/issue_labeler.yml — llm injection
• .github/workflows/pypi_publish.yaml — action pins
• .github/workflows/trufflehog.yml — action pins

Fixed by this PR:

• HIGH unpinned-action (pinact) — .github/workflows/claude_review.yml:39
• HIGH llm_prompt_injection (claude) — .github/workflows/issue_labeler.yml
• HIGH unpinned-action (pinact) — .github/workflows/pypi_publish.yaml:77
• HIGH unpinned-action (pinact) — .github/workflows/trufflehog.yml:20

This does not fix everything. 44 further finding(s) (40 high, 4 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/bot_pytest.yml

job	granted	why
gate	pull-requests: write	The raw gh api calls POST a reaction to issues/comments/{id}/reactions and POST a comment to issues/{PR}/comments; on a pull request these are PR comment writes, so pull-requests: write is needed, matching the existing grant.
gpu	contents: read	actions/checkout of the PR head ref needs contents: read; the pytest steps use no token, and upload-artifact within the same run needs no permission.
report	pull-requests: write	The raw gh api PATCH to issues/comments/{CID} edits the bot's comment on the pull request, which needs pull-requests: write.

.github/workflows/codeql.yml

codeql was left as it is — This job only calls the external reusable workflow huggingface/security-workflows/.github/workflows/codeql-reusable.yml, whose job permissions are not visible in this file; the existing grant (security-events: write, packages: read, actions: read, contents: read) matches typical CodeQL needs and should be kept.

.github/workflows/pr_link_issue_reminder.yml

job	granted	why
remind	contents: read, issues: write, pull-requests: write	actions/checkout needs contents: read; the external script utils/remind_link_issue.py (not visible here, so the reviewer should check it) is described as commenting on and closing PRs and reading their labels and linked issues via PyGithub, which needs pull-requests: write and issues: write, since PR comments go through the issues API.

.github/workflows/stale.yml

job	granted	why
close_stale_issues	contents: read, issues: write, pull-requests: write	The 'Close stale issues' step runs utils/stale.py (PyGithub, not in this file), which as a stale bot comments on, labels, and closes issues and PRs, matching the job's existing issues/pull-requests write grants; actions/checkout adds contents: read. Reviewer should confirm the script does nothing beyond issue/PR management.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.