From 959a1841e39ec08546d6bef4588798f6a323d08c Mon Sep 17 00:00:00 2001
From: Christian Larios <clutchpbcfo@gmail.com>
Date: Wed, 12 Aug 2026 20:40:29 -0700
Subject: [PATCH] chore(ci): harden workflow trust boundaries

---
 .github/workflows/test.yml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 64f8552..d17f948 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,6 +18,8 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ matrix.node }}
@@ -31,6 +33,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
@@ -51,8 +55,9 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Secret scan
-        run: docker run --rm -v "$PWD:/repo" zricethezav/gitleaks:v8.28.0 detect --source /repo --no-git --redact --exit-code 1
+        run: docker run --rm -v "$PWD:/repo:ro" zricethezav/gitleaks:v8.30.1@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f detect --source /repo --no-git --redact --exit-code 1
       - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 22
@@ -63,5 +68,8 @@ jobs:
       - run: npm run lint:openapi
       - run: npm audit --omit=dev
       - run: npm pack --dry-run
-      - run: git diff --check origin/${{ github.base_ref || 'main' }}...HEAD
+      - name: Check patch whitespace
+        env:
+          BASE_REF: ${{ github.base_ref || 'main' }}
+        run: git diff --check "origin/${BASE_REF}...HEAD"
       - run: docker build -t hyperagent-codex-bridge:ci .