fix(ci): harden GitHub Actions workflows (#14789)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #14789.

Targets dependabot/github_actions/actions-ca6b5df6ad. Files changed, and what changed them:

• .github/workflows/claude_review.yml — action pins
• .github/workflows/issue_labeler.yml — llm injection
• .github/workflows/pypi_publish.yaml — action pins
• .github/workflows/trufflehog.yml — action pins

Fixed by this PR:

• HIGH unpinned-action (pinact) — .github/workflows/claude_review.yml:39
• HIGH llm_prompt_injection (claude) — .github/workflows/issue_labeler.yml
• HIGH unpinned-action (pinact) — .github/workflows/pypi_publish.yaml:77
• HIGH unpinned-action (pinact) — .github/workflows/trufflehog.yml:20

This does not fix everything. 44 further finding(s) (40 high, 4 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/bot_pytest.yml

job	granted	why
gate	pull-requests: write	Both steps use raw gh api calls with readable endpoints. One adds a reaction to the triggering comment (issues/comments/{id}/reactions). The other posts a comment on the PR (issues/{PR}/comments). On a pull request both are covered by pull-requests: write.
gpu	contents: read	The actions/checkout step on the PR head ref needs contents: read; upload-artifact within the same run needs no permission.
report	pull-requests: write	The raw gh api -X PATCH repos/{repo}/issues/comments/{CID} call edits the bot's comment on the PR, which needs pull-requests: write.

.github/workflows/codeql.yml

codeql was left as it is — Job only calls the external reusable workflow huggingface/security-workflows/.github/workflows/codeql-reusable.yml, whose steps are not in this file; its existing grant (security-events: write, packages: read, actions: read, contents: read) matches typical CodeQL needs but cannot be verified here.

.github/workflows/pr_link_issue_reminder.yml

remind was left as it is — The token's actual use happens inside utils/remind_link_issue.py (PyGithub), which is not in this file; comments suggest it comments on, labels and closes PRs (likely contents: read, pull-requests: write, issues: write as already declared), but its API calls cannot be verified from the workflow.

.github/workflows/stale.yml

job	granted	why
close_stale_issues	contents: read, issues: write, pull-requests: write	The 'Close stale issues' step runs utils/stale.py, which is not shown in this file; given the job name, its PyGithub install and the job's existing grant, it presumably comments on and closes stale issues and PRs (issues: write, pull-requests: write) — reviewers should confirm that script — while actions/checkout needs contents: read.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.