fix(ci): harden GitHub Actions workflows (#208)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #208.

Warning

This changes when the workflow runs and what it can reach. Both triggers and permissions were rewritten in .github/workflows/deploy-to-hf.yml, .github/workflows/update-conferences.yml, .github/workflows/validate-conferences.yml. Read the diff before merging — either one can change what the workflow is able to do.

Targets dependabot/github_actions/actions-2634b28785. Files changed:

• .github/workflows/claude-code-review.yml
• .github/workflows/claude.yml
• .github/workflows/deploy-to-hf.yml
• .github/workflows/update-conferences.yml
• .github/workflows/validate-conferences.yml

Fixed by this PR:

• HIGH unpinned-action (pinact) — .github/workflows/claude-code-review.yml:36
• HIGH broken_auth_gate (claude) — .github/workflows/claude.yml
• HIGH llm_prompt_injection (claude) — .github/workflows/claude.yml
• HIGH unpinned-action (pinact) — .github/workflows/claude.yml:29
• HIGH unpinned-action (pinact) — .github/workflows/claude.yml:35
• HIGH unpinned-action (pinact) — .github/workflows/deploy-to-hf.yml:19
• HIGH excessive-permissions (zizmor) — .github/workflows/update-conferences.yml:4
• HIGH unpinned-action (pinact) — .github/workflows/validate-conferences.yml:18
• HIGH unpinned-action (pinact) — .github/workflows/validate-conferences.yml:19
• MEDIUM excessive-permissions (zizmor) — .github/workflows/deploy-to-hf.yml:1
• MEDIUM excessive-permissions (zizmor) — .github/workflows/deploy-to-hf.yml:14
• MEDIUM excessive-permissions (zizmor) — .github/workflows/validate-conferences.yml:1
• MEDIUM excessive-permissions (zizmor) — .github/workflows/validate-conferences.yml:15

This does not fix everything. 2 further finding(s) (2 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/claude-code-review.yml

job	granted	why
claude-review	contents: read, id-token: write, issues: read, pull-requests: read	actions/checkout needs contents: read, and the anthropics/claude-code-action step reads PR/issue context and performs an OIDC token exchange (id-token: write); note that if the code-review plugin actually posts its review back to the PR, pull-requests: write would be required instead of read — that is the one step to verify.

.github/workflows/claude.yml

job	granted	why
claude	actions: read, contents: read, id-token: write, issues: read, pull-requests: read	actions/checkout needs contents: read, and the anthropics/claude-code-action step needs id-token: write to exchange an OIDC token for its own GitHub App token (which is what performs any comment/commit writes), plus read on issues/pull-requests for the triggering context and actions: read for CI results as declared in additional_permissions; the claude-code-action step is the one to double-check, since if it falls back to GITHUB_TOKEN for posting comments it would require issues: write and pull-requests: write instead.

.github/workflows/deploy-to-hf.yml

job	granted	why
deploy	contents: read	actions/checkout needs contents: read; the only other step pushes to an external Hugging Face remote using the HF_TOKEN secret, which requires no GITHUB_TOKEN permission.

.github/workflows/update-conferences.yml

job	granted	why
update-conferences	contents: write, pull-requests: write	The peter-evans/create-pull-request step pushes the update-conferences branch (contents: write) and opens a PR against main (pull-requests: write); checkout only needs contents: read, and the unverified .github/scripts/update_conferences.py step appears to only fetch external data and write local files, so a reviewer should confirm it makes no API calls of its own.

.github/workflows/validate-conferences.yml

job	granted	why
validate	contents: read	Only actions/checkout needs a token scope (contents: read); npm ci and npm run validate just run the local validation script (scripts/validate-conferences.ts, not shown here) against the checked-out files and make no API calls, so no write scopes are needed — a reviewer may want to confirm that script does not post PR comments.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.