fix(ci): harden GitHub Actions workflows (#208)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #208.

Targets dependabot/github_actions/actions-2634b28785. Files changed, and what changed them:

• .github/workflows/claude-code-review.yml — action pins
• .github/workflows/claude.yml — action pins; auth gate, llm injection
• .github/workflows/deploy-to-hf.yml — action pins
• .github/workflows/validate-conferences.yml — action pins

Fixed by this PR:

• HIGH unpinned-action (pinact) — .github/workflows/claude-code-review.yml:36
• HIGH broken_auth_gate (claude) — .github/workflows/claude.yml
• HIGH llm_prompt_injection (claude) — .github/workflows/claude.yml
• HIGH unpinned-action (pinact) — .github/workflows/claude.yml:29
• HIGH unpinned-action (pinact) — .github/workflows/claude.yml:35
• HIGH unpinned-action (pinact) — .github/workflows/deploy-to-hf.yml:23
• HIGH unpinned-action (pinact) — .github/workflows/validate-conferences.yml:22
• HIGH unpinned-action (pinact) — .github/workflows/validate-conferences.yml:23

This does not fix everything. 2 further finding(s) (2 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/claude-code-review.yml

job	granted	why
claude-review	contents: read, id-token: write, issues: read, pull-requests: write	actions/checkout needs contents: read, and anthropics/claude-code-action running the /code-review plugin reads PR/issue context and posts its review back to the pull request, which requires pull-requests: write (the file itself only declares pull-requests: read, so verify whether this run is expected to comment) plus id-token: write which the action uses for its OIDC-based token exchange.

.github/workflows/claude.yml

job	granted	why
claude	actions: read, contents: read, id-token: write, issues: read, pull-requests: read	actions/checkout needs contents: read, and anthropics/claude-code-action reads issue/PR context (issues: read, pull-requests: read), reads CI results via its declared additional_permissions: actions: read, and uses OIDC (id-token: write) to exchange for its own app token for any comment writes — the action is the step to double-check, since if it falls back to GITHUB_TOKEN for posting comments it would need issues: write/pull-requests: write.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.