fix(ci): harden GitHub Actions workflows (#14789)

[hf-security-analysis]

Automated hardening of the workflow files flagged on #14789.

Targets dependabot/github_actions/actions-ca6b5df6ad. Files changed, and what changed them:

• .github/workflows/claude_review.yml — action pins
• .github/workflows/pypi_publish.yaml — action pins
• .github/workflows/trufflehog.yml — action pins

Fixed by this PR:

• HIGH unpinned-action (pinact) — .github/workflows/claude_review.yml:39
• HIGH unpinned-action (pinact) — .github/workflows/pypi_publish.yaml:77
• HIGH unpinned-action (pinact) — .github/workflows/trufflehog.yml:20

This does not fix everything. 44 further finding(s) (40 high, 4 medium) need a decision this bot should not make for you. They are in the security channel with their locations — deliberately not repeated here, since this repository may be public and they are not fixed yet.

Permissions

.github/workflows/bot_pytest.yml

job	granted	why
gate	pull-requests: write	The raw gh api calls POST a reaction to issues/comments/{id}/reactions and POST a new comment to issues/{PR}/comments; since the target is a PR, pull-requests: write covers both (if the bot were ever triggered from a plain issue, issues: write would be needed instead).
gpu	contents: read	actions/checkout of the PR head ref needs contents: read; pytest needs no token, and upload-artifact within the same run needs no permission.
report	pull-requests: write	The raw gh api -X PATCH repos/.../issues/comments/{CID} call edits the bot's comment on the PR, which needs pull-requests: write.

.github/workflows/codeql.yml

codeql was left as it is — Job only calls the external reusable workflow huggingface/security-workflows/.github/workflows/codeql-reusable.yml, whose steps are not in this file; the existing grant (security-events: write, packages: read, actions: read, contents: read) matches a typical CodeQL analysis but cannot be verified here.

.github/workflows/pr_link_issue_reminder.yml

remind was left as it is — The 'Run reminder script' step runs utils/remind_link_issue.py, which is not in this file; its comments suggest it comments on, labels and closes PRs (pull-requests: write, issues: write, contents: read as already declared), but its exact API use cannot be verified here.

.github/workflows/stale.yml

job	granted	why
close_stale_issues	contents: read, issues: write, pull-requests: write	The python utils/stale.py step's script is not in this file, but its name, the PyGithub install and the job's existing grant show it closes and comments on stale issues and pull requests, needing issues: write and pull-requests: write; actions/checkout needs contents: read — the reviewer should confirm the script does nothing beyond that.

Anything not listed above keeps the permissions it had. To measure a job this could not read, add GitHubSecurityLab/actions-permissions/monitor to it and run the workflow — it reports the minimum the run actually used.

Pinning changes come from pinact and are mechanical. Any other change was generated by Claude — read it before merging.