fix(ci): drop persisted checkout credentials and pass matrix.tool through env (#658)

* fix(ci): drop persisted checkout credentials and pass matrix.tool through env

All nine actions/checkout steps left the job token in .git/config for
every later step, including bun install and bun test in CLI code a pull
request brings (zizmor artipacked). Each now sets
persist-credentials: false; no step needed the stored credential.

cli-checks expanded ${{ matrix.tool }} - a directory name discover-clis
reads from the PR's tree - into its shell script (zizmor
template-injection). It now arrives through env.

upstream-watch.yml grants issues: write to its one job rather than the
whole workflow.

The new stdlib-only test reproduces zizmor's findings on master exactly
(9 artipacked, 1 template-injection at ci.yml:227) and passes here.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* changelog: place the #658 entry under [Unreleased]

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Mads Lorentzen <madslorentzen_17@hotmail.com>

.github/workflows/ci.yml

@@ -21,7 +21,8 @@
 # edit this workflow itself, so these guards catch accidents and casual
 # attempts, not a determined author - branch protection with required checks
 # and human review of workflow/settings diffs remain the real backstop.
-# Actions are pinned to commit SHAs; the token is read-only.
+# Actions are pinned to commit SHAs; the token is read-only, and no checkout
+# leaves it in .git/config (persist-credentials: false) for later steps to read.
 
 name: CI
 
@@ -41,6 +42,7 @@ jobs:
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
+          persist-credentials: false
           fetch-depth: 0
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
@@ -56,6 +58,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"
@@ -70,6 +74,8 @@ jobs:
         python-version: ["3.10", "3.11", "3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}
@@ -89,6 +95,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - name: Probe Dependency graph availability
         id: graph
         run: |
@@ -128,6 +136,8 @@ jobs:
             container: debian:bookworm
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - name: Install apt-packaged TeX Live (bookworm leg)
         if: matrix.leg.name == 'debian-bookworm'
         # --no-install-recommends keeps the leg lean, so the two font packages
@@ -196,6 +206,8 @@ jobs:
       tools: ${{ steps.list.outputs.tools }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - id: list
         run: |
           tools=$(find .agents/skills -mindepth 3 -maxdepth 3 -path '*/cli/package.json' \
@@ -214,17 +226,23 @@ jobs:
         tool: ${{ fromJSON(needs.discover-clis.outputs.tools) }}
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
       - run: bun install
         working-directory: .agents/skills/${{ matrix.tool }}/cli
       - run: bun run typecheck
         working-directory: .agents/skills/${{ matrix.tool }}/cli
       - name: Run fixture/mock tests when present
+        # The tool name is a directory name a pull request controls, so it
+        # reaches the shell as data through env, never as expanded script text.
+        env:
+          TOOL: ${{ matrix.tool }}
         run: |
           if find tests -type f -name '*.test.ts' | grep -q .; then
             bun test
           else
-            echo "No Bun tests found for ${{ matrix.tool }}; skipping"
+            echo "No Bun tests found for $TOOL; skipping"
           fi
         working-directory: .agents/skills/${{ matrix.tool }}/cli
 
@@ -234,6 +252,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
       - name: Tracked template files must keep their placeholder tokens
         run: |
           fail=0

.github/workflows/upstream-watch.yml

@@ -32,7 +32,6 @@ on:
 
 permissions:
   contents: read
-  issues: write
 
 jobs:
   triage:
@@ -41,10 +40,17 @@ jobs:
     # tests/test_upstream_triage.py so a template clone never runs it by surprise.
     if: github.repository != 'MadsLorentzen/ai-job-search'
     runs-on: ubuntu-latest
+    # Issue write is granted to this one job, not the workflow, so a job added
+    # later starts read-only.
+    permissions:
+      contents: read
+      issues: write
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
+          # The fetch below reads a public remote; nothing here pushes.
+          persist-credentials: false
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.12"