From 579c893384387d5088d445bf3452891d9e22688e Mon Sep 17 00:00:00 2001
From: "hf-security-analysis[bot]"
 <265538906+hf-security-analysis[bot]@users.noreply.github.com>
Date: Wed, 16 Sep 2026 08:47:13 +0000
Subject: [PATCH] fix(ci): harden workflow files flagged on #14623

---
 .github/workflows/bot_style.yml     | 21 ++++++++++++---------
 .github/workflows/diffusers_bot.yml |  2 +-
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/bot_style.yml b/.github/workflows/bot_style.yml
index 177ac6b4cf96..10e1ba4bf1d7 100644
--- a/.github/workflows/bot_style.yml
+++ b/.github/workflows/bot_style.yml
@@ -31,7 +31,7 @@ jobs:
     steps:
       - name: Extract PR details
         id: pr_info
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         with:
           script: |
             const prNumber = context.payload.issue.number;
@@ -75,7 +75,7 @@ jobs:
           fi
 
       - name: Verify PR head SHA is unchanged before running untrusted code
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         env:
           EXPECTED_HEAD_SHA: ${{ steps.pr_info.outputs.headSha }}
         with:
@@ -93,7 +93,7 @@ jobs:
             }
 
       - name: Check commit was pushed before the triggering comment
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         env:
           HEAD_SHA: ${{ steps.pr_info.outputs.headSha }}
           HEAD_REPO_FULL_NAME: ${{ steps.pr_info.outputs.headRepoFullName }}
@@ -132,7 +132,7 @@ jobs:
             }
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.10"
 
@@ -158,7 +158,7 @@ jobs:
           fi
 
       - name: Upload style fixes artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         with:
           name: style-bot-output-${{ github.run_id }}
           path: ${{ runner.temp }}/style-bot-output
@@ -180,9 +180,12 @@ jobs:
           private-key: ${{ secrets.HF_BOT_STYLE_SECRET_PEM }}
           owner: ${{ github.repository_owner }}
           repositories: ${{ github.event.repository.name }}
+          # Scope the app token down to the minimum permissions needed
+          # (pushing style-fix commits to the PR branch).
+          permission-contents: write
 
       - name: Re-validate PR head SHA before trusted steps
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         env:
           EXPECTED_HEAD_SHA: ${{ needs.run.outputs.headSha }}
         with:
@@ -218,14 +221,14 @@ jobs:
           fi
 
       - name: Download style fixes artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: style-bot-output-${{ github.run_id }}
           path: ${{ runner.temp }}/style-bot-output
 
       - name: Comment on PR with workflow run link
         id: init_comment
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         env:
           prNumber: ${{ needs.run.outputs.prNumber }}
         with:
@@ -291,7 +294,7 @@ jobs:
           fi
 
       - name: Comment on PR
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # v9.0.0
         env:
           COMMENT_ID: ${{ steps.init_comment.outputs.comment_id }}
           FINAL_COMMENT: ${{ steps.prepare_final_comment.outputs.final_comment }}
diff --git a/.github/workflows/diffusers_bot.yml b/.github/workflows/diffusers_bot.yml
index 15e26fae696f..2d85be33a836 100644
--- a/.github/workflows/diffusers_bot.yml
+++ b/.github/workflows/diffusers_bot.yml
@@ -46,7 +46,7 @@ jobs:
     steps:
       - name: Authorize and parse command
         id: check
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8.0.0
         with:
           script: |
             const commenter = context.payload.comment.user.login;