fix(ci): harden GitHub Actions workflows (#14789)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #14789.

Warning

This changes when the workflow runs and what it can reach. Both triggers and permissions were rewritten in .github/workflows/claude_review.yml, .github/workflows/issue_labeler.yml, .github/workflows/pr_labeler.yml. Read the diff before merging — either one can change what the workflow is able to do.

Targets dependabot/github_actions/actions-ca6b5df6ad. Files changed:

• .github/workflows/bot_pytest.yml
• .github/workflows/claude_review.yml
• .github/workflows/issue_labeler.yml
• .github/workflows/mirror_community_pipeline.yml
• .github/workflows/notify_slack_about_release.yml
• .github/workflows/pr_dependency_test.yml
• .github/workflows/pr_labeler.yml
• .github/workflows/pr_modular_tests.yml
• .github/workflows/pr_test_fetcher.yml
• .github/workflows/pr_tests.yml
• .github/workflows/pr_tests_gpu.yml
• .github/workflows/pr_torch_dependency_test.yml
• .github/workflows/push_tests.yml
• .github/workflows/push_tests_fast.yml
• .github/workflows/push_tests_mps.yml
• .github/workflows/pypi_publish.yaml
• .github/workflows/release_tests_fast.yml
• .github/workflows/ssh-runner.yml
• .github/workflows/stale.yml
• .github/workflows/trufflehog.yml
• .github/workflows/update_metadata.yml

Fixed by this PR:

• HIGH broken_auth_gate (claude) — .github/workflows/bot_pytest.yml
• HIGH unpinned-action (pinact) — .github/workflows/bot_pytest.yml:78
• HIGH unpinned-action (pinact) — .github/workflows/bot_pytest.yml:119
• HIGH excessive-permissions (zizmor) — .github/workflows/claude_review.yml:10
• HIGH excessive-permissions (zizmor) — .github/workflows/claude_review.yml:11
• HIGH unpinned-action (pinact) — .github/workflows/claude_review.yml:37
• HIGH llm_prompt_injection (claude) — .github/workflows/issue_labeler.yml
• HIGH excessive-permissions (zizmor) — .github/workflows/issue_labeler.yml:9
• HIGH unpinned-action (pinact) — .github/workflows/mirror_community_pipeline.yml:72
• HIGH unpinned-action (pinact) — .github/workflows/mirror_community_pipeline.yml:78
• HIGH unpinned-action (pinact) — .github/workflows/notify_slack_about_release.yml:16
• HIGH unpinned-action (pinact) — .github/workflows/notify_slack_about_release.yml:19
• HIGH unpinned-action (pinact) — .github/workflows/pr_dependency_test.yml:25
• HIGH unpinned-action (pinact) — .github/workflows/pr_dependency_test.yml:27
• HIGH dangerous-triggers (zizmor) — .github/workflows/pr_labeler.yml:3
• HIGH excessive-permissions (zizmor) — .github/workflows/pr_labeler.yml:9
• HIGH unpinned-action (pinact) — .github/workflows/pr_modular_tests.yml:47
• HIGH unpinned-action (pinact) — .github/workflows/pr_modular_tests.yml:49
• HIGH unpinned-action (pinact) — .github/workflows/pr_modular_tests.yml:67
• HIGH unpinned-action (pinact) — .github/workflows/pr_modular_tests.yml:69
• HIGH unpinned-action (pinact) — .github/workflows/pr_modular_tests.yml:95
• HIGH unpinned-action (pinact) — .github/workflows/pr_modular_tests.yml:125
• HIGH unpinned-action (pinact) — .github/workflows/pr_modular_tests.yml:154
• HIGH unpinned-action (pinact) — .github/workflows/pr_test_fetcher.yml:34
• HIGH unpinned-action (pinact) — .github/workflows/pr_test_fetcher.yml:48
• HIGH unpinned-action (pinact) — .github/workflows/pr_test_fetcher.yml:89
• HIGH unpinned-action (pinact) — .github/workflows/pr_test_fetcher.yml:115
• HIGH unpinned-action (pinact) — .github/workflows/pr_test_fetcher.yml:144
• HIGH unpinned-action (pinact) — .github/workflows/pr_test_fetcher.yml:170
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests.yml:42
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests.yml:44
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests.yml:62
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests.yml:64
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests.yml:122
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests.yml:166
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests.yml:198
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests.yml:226
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests.yml:252
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests.yml:293
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:43
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:45
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:63
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:65
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:95
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:113
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:133
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:182
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:205
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:251
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:267
• HIGH unpinned-action (pinact) — .github/workflows/pr_tests_gpu.yml:299
• HIGH unpinned-action (pinact) — .github/workflows/pr_torch_dependency_test.yml:25
• HIGH unpinned-action (pinact) — .github/workflows/pr_torch_dependency_test.yml:27
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:40
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:58
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:78
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:109
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:131
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:166
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:183
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:209
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:226
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:251
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:267
• HIGH unpinned-action (pinact) — .github/workflows/push_tests.yml:298
• HIGH unpinned-action (pinact) — .github/workflows/push_tests_fast.yml:63
• HIGH unpinned-action (pinact) — .github/workflows/push_tests_fast.yml:96
• HIGH unpinned-action (pinact) — .github/workflows/push_tests_mps.yml:29
• HIGH unpinned-action (pinact) — .github/workflows/push_tests_mps.yml:71
• HIGH unpinned-action (pinact) — .github/workflows/pypi_publish.yaml:75
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:39
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:58
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:78
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:109
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:131
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:166
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:183
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:223
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:240
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:266
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:283
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:309
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:326
• HIGH unpinned-action (pinact) — .github/workflows/release_tests_fast.yml:359
• HIGH unpinned-action (pinact) — .github/workflows/ssh-runner.yml:41
• HIGH unpinned-action (pinact) — .github/workflows/stale.yml:18
• HIGH unpinned-action (pinact) — .github/workflows/stale.yml:21
• HIGH unpinned-action (pinact) — .github/workflows/trufflehog.yml:18
• HIGH unpinned-action (pinact) — .github/workflows/update_metadata.yml:21

This does not fix everything. 43 further finding(s) (39 high, 4 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/bot_pytest.yml

job	granted	why
gate	pull-requests: write	The "Acknowledge with 👀" and "Post running comment" steps call gh api -X POST repos/$REPO/issues/comments/$ID/reactions and repos/$REPO/issues/$PR/comments, which write a reaction and a comment on a pull request thread — pull-requests: write covers PR conversation comments; if the bot can ever be invoked on a plain issue, issues: write would also be required, so a reviewer should confirm the trigger is PR-only.
gpu	contents: read	Only actions/checkout of the PR head needs the token (contents: read); the pytest/dependency-install steps use no API and actions/upload-artifact writes within the same run, which needs no scope.
report	pull-requests: write	The "Update comment with final status" step does gh api -X PATCH repos/$REPO/issues/comments/$CID, editing the bot's comment on the PR thread, which requires pull-requests: write (issues: write instead if the command can be run on non-PR issues).

.github/workflows/claude_review.yml

job	granted	why
claude-review	contents: write, issues: read, pull-requests: write	The final "Open follow-up PR with Claude's changes" step pushes branches (git push origin) and runs gh pr create/gh pr comment, requiring contents: write and pull-requests: write; checkout and gh pr view need only read, and issues: read covers reading the triggering issue comment — the step I was least sure about is anthropics/claude-code-action, which in some configurations also wants id-token: write (OIDC) and issues: write for posting on issue threads, so verify that one if the action fails to comment.

.github/workflows/codeql.yml

codeql was left as it is — This job only calls an external reusable workflow (huggingface/security-workflows@e0d40aa), whose steps are not visible in this file, so the actual token use cannot be verified; the job's own declared block (security-events: write, packages: read, actions: read, contents: read) is the conventional CodeQL analysis set and should be checked against that reusable workflow.

.github/workflows/issue_labeler.yml

job	granted	why
label	contents: read, issues: write	actions/checkout needs contents: read, and the "Apply labels" step runs gh issue edit --add-label with GITHUB_TOKEN, requiring issues: write; the "Get labels from LLM" step runs utils/label_issues.py which is not in this file but is only passed HF_TOKEN and issue text, so it appears not to use the repository token — worth a glance by the reviewer.

.github/workflows/pr_labeler.yml

job	granted	why
label	contents: read, pull-requests: write	actions/labeler reads the .github/labeler.yml config from the repo (contents: read) and applies/removes labels on the PR with sync-labels enabled (pull-requests: write).
missing-tests	contents: read, pull-requests: write	actions/checkout drives contents: read and gh pr edit --add-label/--remove-label drives pull-requests: write; the piped script utils/check_test_missing.py is not in this file and has GH_TOKEN in its env, so a reviewer should confirm it only consumes the stdin JSON and makes no further API writes.
fixes-issue	issues: read, pull-requests: write	gh pr edit --add-label/--remove-label requires pull-requests: write; the GraphQL query for closingIssuesReferences and the repos/.../issues/<n>/labels GET motivate the narrower issues: read (it may already be covered by the pull-requests scope).
size-label	pull-requests: write	The single step reads PR additions/deletions and labels via `gh api repos/.../pulls

.github/workflows/pr_link_issue_reminder.yml

remind was left as it is — The only token-consuming step runs python utils/remind_link_issue.py, a script not present in this file, so its actual API calls cannot be verified; the job's own declaration (contents: read, pull-requests: write, issues: write) is consistent with the described comment/label/close behaviour and with actions/checkout, but a reviewer should confirm against the script — in particular whether it needs issues: write at all or only PR comments/labels via pull-requests: write.

.github/workflows/stale.yml

job	granted	why
close_stale_issues	contents: read, issues: write, pull-requests: write	actions/checkout needs contents: read, and the final step runs python utils/stale.py (a PyGithub stale bot using GITHUB_TOKEN) which comments on/labels/closes issues and PRs, hence issues: write and pull-requests: write; the script body is not in this file, so a reviewer should confirm it does not also push commits or touch other APIs.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.