fix(ci): harden GitHub Actions workflows (#14789)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #14789.

Targets dependabot/github_actions/actions-ca6b5df6ad. Files changed, and what changed them:

• .github/workflows/claude_review.yml — action pins
• .github/workflows/issue_labeler.yml — llm injection
• .github/workflows/pypi_publish.yaml — action pins
• .github/workflows/trufflehog.yml — action pins

Fixed by this PR:

• HIGH unpinned-action (pinact) — .github/workflows/claude_review.yml:39
• HIGH llm_prompt_injection (claude) — .github/workflows/issue_labeler.yml
• HIGH unpinned-action (pinact) — .github/workflows/pypi_publish.yaml:77
• HIGH unpinned-action (pinact) — .github/workflows/trufflehog.yml:20

This does not fix everything. 44 further finding(s) (40 high, 4 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/bot_pytest.yml

job	granted	why
gate	pull-requests: write	Raw gh api calls with literal paths add a reaction to the triggering comment and post a comment via repos/.../issues/${PR}/comments; on a pull request these endpoints accept pull-requests: write, which the job already declares.
gpu	contents: read	actions/checkout of the PR head needs contents: read; the install and pytest steps use no token, and upload-artifact within the same run needs no permission.
report	pull-requests: write	A raw gh api -X PATCH repos/.../issues/comments/${CID} call edits the bot's PR comment, which needs pull-requests: write on a pull request.

.github/workflows/codeql.yml

codeql was left as it is — This job only calls the external reusable workflow huggingface/security-workflows/.github/workflows/codeql-reusable.yml, whose job permissions are not visible in this file; the existing grant (security-events: write, packages: read, actions: read, contents: read) is typical for CodeQL analysis and should likely be kept.

.github/workflows/pr_link_issue_reminder.yml

remind was left as it is — The 'Run reminder script' step runs utils/remind_link_issue.py, whose contents are not in this file; per the job's comments it posts reminder comments on PRs and closes them, and checks linked issues and labels. That is consistent with the existing declaration of pull-requests: write and issues: write, and checkout needs contents: read. The reviewer should verify the script against this set.

.github/workflows/stale.yml

job	granted	why
close_stale_issues	contents: read, issues: write, pull-requests: write	The 'Close stale issues' step runs utils/stale.py, whose contents are not in this file; by its name, its PyGithub dependency and the job's existing grant, it comments on, labels and closes stale issues and PRs, so issues: write and pull-requests: write are kept, and actions/checkout adds contents: read. Reviewers should confirm the script needs nothing beyond this.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.

[hf-security-analysis]

Replaced by one pull request per kind of fix, so each can be reviewed and merged on its own:

• Action pins: fix(ci): pin GitHub Actions to commit SHAs (#14789) #15031
• Workflow design: fix(ci): harden workflow triggers, secrets and gates (#14789) #15032