ci: correct three wrong action-pin version comments and enforce the form (#3313)

[Xore]

Summary

Two commits' worth of audit, one small change. The headline finding is that most of #3313 was already merged as #3388 (e747d91f, an ancestor of main), and the issue is still open because it was never closed. The issue table in the task brief is pre-#3388 and no longer describes main.

I re-derived every claim in the issue from scratch against current main rather than trusting the table, then fixed what was genuinely still wrong.

Already complete on main (verified, nothing to do)

• 39 of 39 actions/checkout steps carry persist-credentials: false. Zero gaps.
• Zero tag-pinned uses: — every third-party reference is a full 40-char SHA.
• Every workflow-level permissions: is {} or read-only. Both items the issue called out by name (dependabot-auto-merge.yml, the five *-watch.yml) are already {} at workflow level with the write scope moved to the one job that spends it.

The grep -rc count the brief asks for is misleading and worth flagging: it reports diagnostics.yml:2 checkouts and quality.yml:23, but those extra hits are the string actions/checkout inside comments — diagnostics.yml states twice that it deliberately has no checkout. Counting actions/checkout@ (a real uses:) gives 39.

I also independently re-verified every grant rather than assuming the merged commit's summary: frontend-testing-pilot.yml's issues: write is spent by github.rest.issues.create; main-health-watch.yml's actions: write is spent by the workflow_dispatch at scripts/main-health-watch.py:174; dependabot-auto-merge.yml uses gh pr review/merge/comment. All justified — nothing to narrow. No pull_request_target and no head.sha checkout anywhere.

Actually still broken — fixed here

#3388's own message claims it fixed "quality.yml's two setup-node pins [that] said # v7". Two # v7 comments survived it, and a third pin was labelled with a major it is not in at all:

location	was	is	ground truth (git ls-remote)
quality.yml:453	# v7	# v7.0.0	820762786 is the commit behind both v7 and v7.0.0
quality.yml:648	# v7	# v7.0.0	same
weekly-schemathesis.yml:276	# v6	# v4.6.2	ea165f8d is the commit behind both v4 and v4.6.2; v6 is b7c566a, a different commit

ea165f8d is the SHA all seven other upload-artifact pins in the tree use, so I corrected the comment to match the code rather than bumping the major to match the comment — that would be a build-logic change, not a pin fix.

Enforcement, because that is how both survived

zizmor's unpinned-uses audit reads the SHA and ignores the comment entirely, so a pin can be perfectly well-formed and still misreport what it runs. persist-credentials: false is enforced (zizmor folds it into artipacked, medium, blocking — confirmed by probing a deliberately non-compliant checkout). The version comment was enforced by nothing.

The new check lives in the existing #3314 lint gate: offline, deterministic, asserts a full # vX.Y.Z on every SHA pin. Proven both directions against the pre-fix tree — it fails on all three lines above and on a pin with no comment at all, and passes on the fixed tree.

Issues

Refs #3313 — deliberately Refs, not Closes. The bulk of the work landed via #3388; this finishes the remaining comments and the missing guard. #3313 should be closed by a human who is satisfied #3388 covered the rest, not silently by this PR. Not merged — left open as instructed.

Security impact

• No real credentials, private addresses, payloads, PCAPs, keys, or .env files were added.
• Sandbox/network-isolation implications were reviewed. (This is the shared self-hosted honeypot-ci runner, so the credential surface is the point: no checkout leaves a token in .git/config, and the comment now correctly says which action version a compromised job would load.)
• Publicly exposed ports and routes are unchanged.

No check was weakened, no test edited, and no new finding was allowlisted. The ADVISORY set is untouched.

Validation

$ zizmor --offline --min-severity medium .github/workflows
error[dangerous-triggers]  --> main-health-watch.yml:7
78 findings (10 ignored, 67 suppressed): 0 informational, 0 low, 0 medium, 1 high

Identical to the pre-change baseline — same counts, same single advisory. Under the repo's own ADVISORY classification: advisory 1 dangerous-triggers, blocking=0 → gate PASSES.

$ grep -rc persist-credentials .github/workflows/*.yml   # 39 checkouts, 39 flagged, 0 gaps
$ SHELLCHECK_OPTS="-S warning" actionlint -color          # exit 0, clean
$ new pin-comment gate                                    # GATE PASSES

I verified all 83 distinct pins resolve to the tag their comment claims, via git ls-remote (annotated tags peeled at ^{}), not the release page. That is how the # v6 defect was caught. One earlier apparent failure was a bug in my own checker — I had passed an action subpath as the repository — so github/codeql-action@1c5b675 is correct, not a finding.

Not validated: the gate asserts the form # vX.Y.Z, not that each comment is tag-accurate. A full-semver-but-wrong comment (the # v6 case) would still pass. I verified truthfulness by hand for all 83 pins and the result is clean, but I did not add a network-dependent ls-remote check to CI: it would make a lint gate depend on 15 upstream repos staying put, and a force-moved or deleted tag would fail a PR for reasons unrelated to it. Worth adding later as a scheduled audit rather than a per-PR blocking check. I also did not re-run the full Quality suite locally — the self-hosted lanes need the runner. rustfmt for the 1.98.0 toolchain is unavailable here (pre-existing).

Rollout

None. No deploy step. #3313 can be closed once a reviewer confirms #3388 covered the rest.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None