fix(ci): PAT-reachability fallback + pin-ref shape guard for the data-ingestors jobs

[LukasWodka]

What

Fixes two Cursor Bugbot findings surfaced on the #323 promotion re-review of the data-ingestors drift jobs. Both are pre-existing and advisory (neither is a required check), but worth closing.

1. Invalid PAT breaks canary checkout (Medium)

head-drift-canary.yml passed secrets.CROSS_REPO_READ_TOKEN || github.token straight to actions/checkout. || only falls back when the secret is empty, so a set-but-expired / mis-scoped PAT reds the weekly canary even though data-ingestors is public and github.token would work.

Fix: ported goldens-drift.yml's reachability probe — a git ls-remote check selects the PAT only when it actually works and falls back to the default token otherwise (use_pat output kept in lockstep with the checkout). goldens-drift.yml already had this; only the canary was missing it.

2. Pin ref lacks shape guard (Low)

goldens-drift.yml and head-drift-canary.yml read scripts/.data-ingestors-ref with only an emptiness check — and goldens-drift.yml passes it straight to actions/checkout — unlike chart-drift.yml, which validates ref shape. A malformed pin then fails opaquely at checkout.

Fix: added chart-drift.yml's guard to both pin-resolution steps — SHA / branch / tag characters only, no .. — so a bad pin fails with a clear ::error instead.

Verification

• Shape guard accepts the real pin, develop, a 40-char SHA, release/v1.2.3; rejects../../etc/passwd, foo..bar, x;rm -rf /, $(whoami), empty.
• Probe no-token path selects github.token.
• actionlint + shellcheck clean, YAML valid.

Once merged to develop, #323 inherits it.

---

Note

Low Risk
CI-only workflow shell changes; no application auth, data paths, or runtime behavior.

Overview
Hardens the data-ingestors drift workflows so bad pins and broken cross-repo tokens fail predictably instead of deep in checkout.

Pin resolution in goldens-drift.yml and head-drift-canary.yml now validates scripts/.data-ingestors-ref the same way as chart-drift.yml: allowed ref characters only, no .., with a clear ::error before checkout uses the value.

HEAD-drift canary no longer passes CROSS_REPO_READ_TOKEN to checkout whenever the secret is merely set. A new git ls-remote probe picks the PAT only when it can read the repo; expired or mis-scoped PATs fall back to github.token, matching the probe/checkout pairing already used in goldens-drift.yml.

^{Reviewed by Cursor Bugbot for commit 7e2c233. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

@BugBot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 7e2c233. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 48 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#182 — feat(weights): averaging writes SafeTensors (TF + PyTorch) — SEC-03 §8 step 4 · author: @shujaatTracebloc · reviewer: @divyasinghds
• averaging-service#183 — docs: SafeTensors deployment-order & resume-safety runbook (epic feat(auth): logout revokes the token server-side (cli#112) #116) · author: @shujaatTracebloc · reviewer: @saadqbal
• averaging-service#184 — test(weights): shared SafeTensors golden-corpus drift guard + declare safetensors dep (SEC-03) · author: @LukasWodka · no reviewer assigned
• averaging-service#185 — test(weights): average a real SafeTensors edge + a legacy edge in one cycle — SEC-03 §8 · author: @LukasWodka · no reviewer assigned
• backend#1093 — chore(deps): bump django from 5.2.14 to 5.2.15 · author: @dependabot · no reviewer assigned
• backend#1108 — test(api): CLI response-shape contract fixtures for the 9 CLI endpoints (WS-D.2) · author: @LukasWodka · reviewer: @saadqbal
• backend#1111 — feat(download): edge weights fetch tolerates .safetensors (SEC-03 step 5c hardening) · author: @shujaatTracebloc · reviewer: @saadqbal
• backend#1112 — fix(runners): migrate deprecated trainingClasses/getTrainingPlan to snake_case (#1102) · author: @LukasWodka · reviewer: @saqlainsyed007
• backend#1114 — perf(leaderboard): serializer prefetch reads + TeamSerializer is_* in Python (#978 pt2) · author: @aptracebloc · reviewer: @saqlainsyed007
• backend#1115 — perf(experiments): bulk-compute landing experiment count/status; O(1) is_archived (#978 pt3) · author: @aptracebloc · reviewer: @saqlainsyed007

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)