fix(security): pull_request_target vulnerabilities and expression injection

[360rb]

Summary

• Replace pull_request_target with pull_request in adapter-code-coverage.yml and semgrep.yml (CRITICAL)
• Fix expression injection in cross-repo-issue.yml by moving attacker-controlled inputs to env vars
• Add fork-detection conditions to skip write operations for fork PRs where tokens are read-only
• Add explicit permissions blocks for least-privilege

Vulnerabilities Fixed

CRITICAL: adapter-code-coverage.yml and semgrep.yml

Both workflows use pull_request_target and check out the fork PR code:

ref: ${{github.event.pull_request.head.ref}}
repository: ${{github.event.pull_request.head.repo.full_name}}

Then execute untrusted code:

• adapter-code-coverage.yml: Runs go test, loads JS via require() from PR code, has contents: write + pull-requests: write
• semgrep.yml: Runs semgrep, loads JS via require() from PR code, has pull-requests: write

An attacker can modify .github/workflows/helpers/pull-request-utils.js in their fork PR to exfiltrate the write-access GITHUB_TOKEN, enabling full repository takeover.

LOW: cross-repo-issue.yml (expression injection)

${{ github.event.pull_request.title }} used directly in a run: block without sanitization. A malicious PR title could execute arbitrary shell commands. This only fires on merged PRs (requiring maintainer approval), but is still a defense-in-depth issue.

Reference

This is the exact attack vector exploited by hackerbot-claw as documented by StepSecurity.

Changes

File	Severity	Change
adapter-code-coverage.yml	CRITICAL	pull_request_target -> pull_request, pin to head.sha, fork-check on write ops
semgrep.yml	CRITICAL	pull_request_target -> pull_request, pin to head.sha, fork-check on write ops
cross-repo-issue.yml	LOW	Move pull_request.title to env var, add permissions block

Behavioral changes

• Same-repo PRs: No change in behavior
• Fork PRs: Coverage reports and semgrep comments will not be posted (tokens are read-only for forks), but the checks themselves still run and report pass/fail correctly
• cross-repo-issue.yml: Retains pull_request_target (necessary for secrets access on merged PRs), but expression injection is fixed

Test plan

• Verify adapter-code-coverage check runs on a same-repo PR touching adapters/
• Verify semgrep check runs on a same-repo PR touching adapters/
• Verify cross-repo issue creation still works when a PR is merged
• Confirm fork PRs trigger checks without errors (write steps are skipped)

🤖 Generated with Claude Code