fix(ci): harden GitHub Actions workflows (#1388)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #1388.

Warning

This narrows what the workflow can reach. Job permissions were declared in .github/workflows/quality.yaml, .github/workflows/slow_tests.yaml, .github/workflows/tests.yaml. Each job now gets only the scopes its steps were read to need — if one of them does something this could not see, it will fail on the next run. The table below says which step drove each scope.

Targets dependabot/github_actions/actions-cb4a383b20. Files changed:

• .github/workflows/quality.yaml
• .github/workflows/slow_tests.yaml
• .github/workflows/tests.yaml
• .github/workflows/trufflehog.yml
• .github/workflows/vllm_main_tests.yaml

Fixed by this PR:

• HIGH unpinned-action (pinact) — .github/workflows/tests.yaml:18
• HIGH unpinned-action (pinact) — .github/workflows/tests.yaml:23
• HIGH unpinned-action (pinact) — .github/workflows/tests.yaml:30
• HIGH unpinned-action (pinact) — .github/workflows/tests.yaml:37
• HIGH unpinned-action (pinact) — .github/workflows/tests.yaml:44
• HIGH unpinned-action (pinact) — .github/workflows/trufflehog.yml:18
• HIGH unpinned-action (pinact) — .github/workflows/vllm_main_tests.yaml:26
• HIGH unpinned-action (pinact) — .github/workflows/vllm_main_tests.yaml:31
• HIGH unpinned-action (pinact) — .github/workflows/vllm_main_tests.yaml:43
• MEDIUM excessive-permissions (zizmor) — .github/workflows/quality.yaml:1
• MEDIUM excessive-permissions (zizmor) — .github/workflows/quality.yaml:14
• MEDIUM excessive-permissions (zizmor) — .github/workflows/slow_tests.yaml:1
• MEDIUM excessive-permissions (zizmor) — .github/workflows/slow_tests.yaml:13
• MEDIUM excessive-permissions (zizmor) — .github/workflows/tests.yaml:1
• MEDIUM excessive-permissions (zizmor) — .github/workflows/tests.yaml:13

This does not fix everything. 7 further finding(s) (1 high, 6 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/doc-build.yml

build was left as it is — This job only delegates to the external reusable workflow huggingface/doc-builder/.github/workflows/build_main_documentation.yml, whose job-level permissions are not visible in this file, so the required scopes cannot be read from the steps here.

.github/workflows/doc-pr-build.yml

build was left as it is — This job only delegates to the external reusable workflow huggingface/doc-builder@cf20b09, which is not in this file, so its token usage (checkout plus any PR doc upload) cannot be verified here.

.github/workflows/doc-pr-upload.yml

build was left as it is — This job only delegates via uses: to the external reusable workflow huggingface/doc-builder/.github/workflows/upload_pr_documentation.yml, which is not in this file, so its token needs (likely actions: read to fetch the build artifact from the triggering run, possibly pull-requests: write for a preview comment — though a GitHub App token appears to be used for that) cannot be verified here.

.github/workflows/quality.yaml

job	granted	why
check_code_quality	contents: read	Only actions/checkout needs the token (contents: read); the remaining steps install Python dependencies and run make quality locally, which uses no GitHub API.

.github/workflows/slow_tests.yaml

job	granted	why
run_tests	contents: read	Only actions/checkout (with LFS) needs the token for source read; setup-uv, actions/cache and the pytest run use no GitHub API write operations.

.github/workflows/tests.yaml

job	granted	why
run_tests	contents: read	Only actions/checkout (with LFS) needs the token for contents: read; the cache steps, uv setup, and pytest run use no GitHub API, and the HF_TEST_TOKEN secret does not imply any scope.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.