fix(security): pin third-party action and stop persisting checkout credentials

[0xDEnYO]

Which Linear task belongs to this PR?

Fixes EXSC-730

Why did I implement it this way?

This PR resolves 18 of the open Aikido SAST findings on main (1× high "3rd party Github Actions should be pinned", 17× low "GitHub Action actions/checkout persist Git credentials"):

• Pinning (disabled/unreviewedPRReminder.yml): slackapi/slack-github-action@v2.0.0 and actions/checkout@v3 are the last two tag-pinned actions in the repo. Both are now pinned to their release commit SHAs per [CONV:ACTIONS-IMMUTABLE] (aikido:237703240). The workflow lives under disabled/ but the convention applies to everything that could be re-enabled.
• persist-credentials: false on the 17 flagged actions/checkout steps whose jobs never push with the runner token afterwards. Each of these jobs is read-only w.r.t. git after checkout; gh-based label/PR operations in those workflows authenticate via env: tokens, not the persisted git extraheader, so nothing changes behaviorally — the runner token just no longer lingers in .git/config for later steps/actions to read.

Deliberately not changed (ignored in Aikido with reasons instead): the checkouts in syncLedgerClearSigning.yml (ledger-registry fork), types.yaml (lifi-contract-types), and updateLouperViem.yml (louper-v3) — those persist scoped credentials on purpose because later steps git push with them.

Known prior-decision conflict, called out proactively: PR #1901 deliberately declined persist-credentials: false on the submodules: recursive checkout in validateScripts.yml (concern: post-job submodule credential cleanup failing the job), and CodeRabbit stored that as a repo Learning. This PR applies the flag there and to forge-unit-tests.yml's matrix checkout anyway, on the strength of newer evidence: syncLedgerClearSigning.yml has combined submodules: recursive + persist-credentials: false in continuously green production runs since May (most recently 2026-07-30). This PR's own CI runs both modified workflows — if the cleanup concern materializes, the two submodule-checkout flags get reverted and those two findings ignored in Aikido citing #1901 instead.

Checklist before requesting a review

• I have performed a self-review of my code
• This pull request is as small as possible and only tackles one problem
• I have added tests that cover the functionality / test the bug
• For new facets: I have checked all points from this list: https://www.notion.so/lifi/New-Facet-Contract-Checklist-157f0ff14ac78095a2b8f999d655622e
• I have updated any required documentation

Checklist for reviewer (DO NOT DEPLOY and contracts BEFORE CHECKING THIS!!!)

• I have checked that any arbitrary calls to external contracts are validated and or restricted
• I have checked that any privileged calls (i.e. storage modifications) are validated and or restricted
• I have ensured that any new contracts have had AT A MINIMUM 1 preliminary audit conducted on by <company/auditor>

[coderabbitai]

Walkthrough

The workflows disable persisted checkout credentials. The disabled reminder workflow pins its checkout and Slack actions to commit SHAs. The Aikido catalog documents an exception for explicitly credentialed checkouts followed by authenticated pushes.

Changes

Workflow hardening

Layer / File(s)	Summary
Checkout and action hardening .github/workflows/*.yml, .github/workflows/disabled/unreviewedPRReminder.yml	Workflow checkout steps now set persist-credentials: false. The disabled reminder workflow pins its checkout and Slack actions to commit SHAs.
Aikido catalog guidance .agents/references/aikido-false-positive-catalog.md	The catalog documents the gha_persist_credentials_push_checkout pattern, exclusions, ignore reason, and custom Aikido context.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the primary security changes: pinning third-party actions and disabling persisted checkout credentials.
Description check	✅ Passed	The description explains the security changes, scope, exclusions, prior-decision conflict, linked task, and checklist status.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Fix failing CI checks

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/aikido-workflow-hardening

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/healthCheckForNewNetworkDeployment.yml:
- Line 24: Update the workflow steps that run “git fetch origin main --depth=1”
and “git show origin/main:config/networks.json” to provide GITHUB_TOKEN
credentials for these read-only Git operations, while preserving
persist-credentials: false elsewhere.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a1b197e1-571a-46be-988e-31499691c2f1

📥 Commits

Reviewing files that changed from the base of the PR and between c72ce47 and cebcfc4.

📒 Files selected for processing (17)

• .github/workflows/assignRequiresTypesLabel.yml
• .github/workflows/bunLockfileCheck.yml
• .github/workflows/deploy-smoke-test.yml
• .github/workflows/diamondEmergencyPause.yml
• .github/workflows/disabled/unreviewedPRReminder.yml
• .github/workflows/forge-unit-tests.yml
• .github/workflows/healthCheckForNewNetworkDeployment.yml
• .github/workflows/jsonChecker.yml
• .github/workflows/markdownlint.yml
• .github/workflows/networkRpcsChecker.yml
• .github/workflows/notifyDataTeamOnDeployment.yml
• .github/workflows/olympixStaticAnalysis.yml
• .github/workflows/protectAuditLabels.yml
• .github/workflows/protectSecurityRelevantCode.yml
• .github/workflows/securityAlertsReview.yml
• .github/workflows/validateScripts.yml
• .github/workflows/versionControlAndAuditCheck.yml

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agents/references/aikido-false-positive-catalog.md:
- Around line 110-114: Update the `gha_persist_credentials_push_checkout`
catalog entry’s “Matches when” predicate to require all three conditions:
`actions/checkout` uses a dedicated non-ambient credential, a later step in the
same job performs an authenticated `git push` (not merely `git commit`), and the
workflow is triggered by a trusted event. Preserve the existing real-finding
guidance for untrusted triggers, API-only authentication, and checkouts without
a qualifying push.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 67490dc3-adf5-4833-8ab6-c985c3bdfc44

📥 Commits

Reviewing files that changed from the base of the PR and between cebcfc4 and 350771e.

📒 Files selected for processing (1)

• .agents/references/aikido-false-positive-catalog.md

[0xDEnYO]

🔒 Gate review (local trial) — residual findings

Auto-fixed in 8d7aeb537: the two read-only checkouts missed in the first pass (forge-unit-tests.yml detect-changes job, versionControlAndAuditCheck.yml version-control job — both flagged independently by two review agents) and an overstated blanket claim in the new catalog entry's sast_context.

Escalated — needs a maintainer decision:

1. submodules: recursive + persist-credentials: false contradicts the PR feat(EXSC-331): static validation of touched TS scripts (pre-push hook + CI workflow) #1901 decision (and a stored CodeRabbit Learning) for validateScripts.yml and forge-unit-tests.yml. Kept deliberately — syncLedgerClearSigning.yml has run the identical combo green since May — and this PR's own CI is the empirical test once it leaves draft (details added to the PR body). If run-unit-tests / validate-scripts fail on post-job cleanup here, the right move is reverting those two flags and ignoring findings 348463789/348463768 in Aikido citing feat(EXSC-331): static validation of touched TS scripts (pre-push hook + CI workflow) #1901.
2. Convention placement: the "read-only checkouts set persist-credentials: false; push-checkouts keep scoped credentials" rule now exists only in the Aikido false-positive catalog. If it should bind future workflow authoring, it belongs as a [CONV:ACTIONS-PERSIST-CREDENTIALS] section in .agents/rules/500-github-actions.md — left for a maintainer since it establishes repo-wide convention.

Verified clean (falsification pass): both SHA pins exactly match their upstream tags; all 19 flagged+added checkouts traced — no job performs an authenticated git operation with the runner token afterwards (gh/API steps all use env tokens); the three push-checkouts (syncLedgerClearSigning.yml, types.yaml, updateLouperViem.yml) untouched; all 9 submodules public https; 17/17 changed YAML files parse.