Review backlog (security): Pre-existing inline ${{ inputs.* }} interpolation in run: blocks of merge/force-reset steps

[hivecommons-hive]

Filed from an out-of-scope finding in the Hive review of PR #544.

PR: #544
Perspective: security
Evidence: .github/workflows/reusable-sync-branches.yml:158
Severity: low

Merge (126-134) and Force-reset (151-164) steps still interpolate inputs.source_branch/target_branch directly into shell. Inputs come from the trusted caller workflow so exploitability is low, but the PR's new steps use env vars; migrating the remaining steps would make the file consistent and remove the injection surface.

[dtg01100]

The fix for this finding is implemented and ready, but it cannot be pushed from this agent environment: the change is entirely inside .github/workflows/reusable-sync-branches.yml, and the token available to this session (gho_…, scopes gist, read:org, repo) lacks the workflow scope, so GitHub rejects any push or Git Data API write that touches a file under .github/workflows/.

remote: ! [remote rejected] fix/sync-branches-env-vars -> fix/sync-branches-env-vars
(refusing to allow an OAuth App to create or update workflow `.github/workflows/reusable-sync-branches.yml` without `workflow` scope)

Verified this is scope, not content: a probe branch touching only docs/** + tests/** pushes fine; the same push fails the moment .github/workflows/reusable-sync-branches.yml is in the tree.

What is ready (single commit dbcd2b4 on local branch fix/sync-branches-env-vars, based on upstream/main @ 0debf71, all 577 tests in the suite green):

• .github/workflows/reusable-sync-branches.yml — all four steps (Check if sync is needed, Detect divergence, Merge source into target, Force-reset target to source) now declare SOURCE_BRANCH / TARGET_BRANCH (and AHEAD) in an env: block and reference them as quoted shell variables. The AHEAD step output moves to env for the same reason. Behaviour is unchanged, including the --force-with-lease="${TARGET_BRANCH}:${TARGET_SHA}" pinning. This is what the issue asks for plus the two preceding steps, which had the identical inline interpolation on main and would otherwise have left the file inconsistent.
• tests/test_sync_branches_input_interpolation.py (new, 7 tests) — asserts no run: block in the file interpolates ${{ inputs.* }}, that the merge/force-reset steps receive the branches via env:, that --force-with-lease still pins the target, and that any step referencing a branch name declares it in env:.
• .github/workflows/unit-tests.yml — adds the workflow to the push/pull_request paths: lists. Without this the repo's own tests/test_unit_test_gate_scope.py fails, because editing reusable-sync-branches.yml would otherwise never run the new guard.
• docs/skills/composite-actions/reusable-workflow.md — the env:-not-inline rule was documented only for composite actions; reusable workflows drifted because nothing stated it applied to .github/workflows/reusable-*.yml too. Adds that section (per AGENTS.md's self-improvement mandate).

To land it, either re-run this task with a token carrying the workflow scope, or push the branch directly. Nothing needs a design decision.

Note for whoever merges: open PR #544 rewrites the same file (it adds allow_force_reset and a "Refuse to discard diverged history" step, and already uses the env: style). This branch is built on main, so #544 will need a rebase — but the two changes do not conflict logically, only textually.

— hive: backend=pi model=kilocode/stealth/space-bunny-alpha

🐝 Hive Agent: contributor | SHA: dbcd2b4