RUST-2008 Remove and forbid add_expansions_to_env

[isabelatkinson]

release dry run patch: https://spruce.corp.mongodb.com/version/6a6b53620bee4300075d44b3/tasks?sorts=STATUS%3AASC%3BBASE_STATUS%3ADESC

The check is implemented as a Github action because it is more lightweight - so far, it appears to take ~5 seconds to run.

[semgrep-code-mongodb]

Semgrep identified an issue in your code:

actions/checkout@v7 uses a movable tag, so a repointed v7 release could make this pull-request workflow run attacker-controlled code.

More details about this

actions/checkout@v7 pulls a GitHub Action by a mutable tag instead of an exact commit. If the v7 tag is ever moved by the action publisher or by someone who compromises that repository, this workflow will run the new code automatically in check-for-add-expansions-to-env the next time a pull request triggers it.

A plausible attack looks like this:

1. An attacker gains control of the actions/checkout repository or its release process and repoints the v7 tag to a malicious commit.
2. A contributor opens any pull request, which triggers on: pull_request in this workflow.
3. The step - uses: actions/checkout@v7 downloads and runs the attacker-controlled action code before your git grep check starts.
4. That action code now executes on the GitHub runner with access to the checked-out repository and the job context, so it could alter the workspace, exfiltrate data available to the job, or tamper with the results of the forbidden-string check.

Because the reference is @v7 rather than a full 40-character SHA, the exact code run by this workflow can change without any change to this repository.

To resolve this comment:

✨ Commit fix suggestion

1. Replace the mutable GitHub Action reference with a full 40-character commit SHA in the uses line.
2. Update uses: actions/checkout@v7 to uses: actions/checkout@<full-commit-sha> and keep the version as a comment if you want readability, for example uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v4.
3. Choose the SHA from the exact action release you intend to trust, from the actions/checkout repository release or tag source, instead of using a tag like @v7. Pinning to a commit SHA prevents the referenced action code from changing without an explicit workflow update.

💬 Ignore this finding

Reply with Semgrep commands to ignore this finding.

• /fp <comment> for false positive
• /ar <comment> for acceptable risk
• /other <comment> for all other reasons

Alternatively, triage in Semgrep AppSec Platform to ignore the finding created by github-actions-mutable-action-tag.

🛟 Help? Slack #semgrep-help or go/semgrep-help.

Resolution Options:

• Fix the code
• Reply /fp $reason (if security gap doesn’t exist)
• Reply /ar $reason (if gap is valid but intentional; add mitigations/monitoring)
• Reply /other $reason (e.g., test-only)

_{You can view more details about this finding in the Semgrep AppSec Platform.}

[isabelatkinson]

/ar actions/checkout is officially maintained by Github. Tagging the version means we will pull in bug fixes and improvements automatically.