fix(ci): harden GitHub Actions workflows (#14789)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #14789.

Warning

This changes when the workflow runs. Triggers or workflow-level settings were rewritten in .github/workflows/pr_labeler.yml. A pull_request_target rewritten to pull_request is the correct fix for the finding and also drops the job's access to secrets — confirm that is what you want before merging.

Targets dependabot/github_actions/actions-ca6b5df6ad. Files changed, and what changed them:

• .github/workflows/claude_review.yml — action pins; llm injection
• .github/workflows/issue_labeler.yml — llm injection
• .github/workflows/pr_labeler.yml — dangerous trigger
• .github/workflows/pypi_publish.yaml — action pins
• .github/workflows/trufflehog.yml — action pins

Fixed by this PR:

• HIGH llm_prompt_injection (claude) — .github/workflows/claude_review.yml
• HIGH unpinned-action (pinact) — .github/workflows/claude_review.yml:39
• HIGH llm_prompt_injection (claude) — .github/workflows/issue_labeler.yml
• HIGH dangerous-triggers (zizmor) — .github/workflows/pr_labeler.yml:3
• HIGH unpinned-action (pinact) — .github/workflows/pypi_publish.yaml:77
• HIGH unpinned-action (pinact) — .github/workflows/trufflehog.yml:20

This does not fix everything. 43 further finding(s) (39 high, 4 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/bot_pytest.yml

job	granted	why
gate	pull-requests: write	The 'Acknowledge with 👀' and 'Post "running" comment' steps call gh api -X POST repos/$REPO/issues/comments/.../reactions and repos/$REPO/issues/$PR/comments, which write comment data on a pull request — pull-requests: write covers this for PR comments (if the bot is ever triggered on a plain issue, issues: write would be needed instead).
gpu	contents: read	Only actions/checkout of the PR head needs a token (contents: read); the pytest run and actions/upload-artifact within the same run require no additional scopes.
report	pull-requests: write	The 'Update comment with final status' step runs gh api -X PATCH repos/$REPO/issues/comments/$CID, editing the bot's comment on the pull request, which needs pull-requests: write (or issues: write if used on non-PR issues).

.github/workflows/codeql.yml

codeql was left as it is — This job only calls an external reusable workflow (huggingface/security-workflows@e0d40aa), whose step contents are not in this file, so the actual token use cannot be verified; the existing block (security-events: write, packages: read, actions: read, contents: read) matches typical CodeQL analysis/upload needs and should be checked against that reusable workflow.

.github/workflows/pr_link_issue_reminder.yml

remind was left as it is — actions/checkout needs contents: read, and the final step runs utils/remind_link_issue.py, whose source is not in this file — per the job's own description it comments on, labels and auto-closes PRs (pull-requests: write, plus issues: write since PR comments/labels go through the issues API), so the listed set mirrors the declared one but a reviewer should confirm against that script.

.github/workflows/stale.yml

job	granted	why
close_stale_issues	contents: read, issues: write, pull-requests: write	actions/checkout needs contents: read, and the final step runs utils/stale.py (a PyGithub stale bot using GITHUB_TOKEN) which comments on/closes stale issues and PRs — the script body is not in this file, so verify it only touches issues/PRs and does not write repository contents.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.