[Sync] Update project files from source repository (c939592)

[mrz1836]

What Changed

• Standardized label descriptions in .github/labels.yml to use ASCII hyphens and <= instead of Unicode en-dashes and ≤ (affecting size/XS, size/S, size/M, and size/L labels)
• Added security hardening across GitHub Actions composite actions by routing input variables through environment variables to prevent injection attacks (applied to setup-benchstat, setup-go-with-cache, setup-mage, parse-env, configure-redis, extract-module-dir, warm-cache, and warm-redis-cache)
• Enhanced validate-test-results action with improved error handling, structured logging with emojis, and more granular validation steps
• Updated download-artifact-resilient action to use environment variables for artifact names and improved error messages
• Modified workflow files to use environment variable interpolation (${{ env.VAR }}) instead of direct input interpolation for version pinning and configuration values
• Changed MAGE_X_VERSION in .github/env/00-core.env from v1.12.1 to v1.12.2
• Refactored dependabot-auto-merge.yml workflow with improved structure, security checks, and clearer step separation
• Added inline documentation explaining SonarCloud false positive suppressions for go install commands with pinned versions

Why It Was Necessary

• Prevents potential command injection vulnerabilities by ensuring user-controlled or configuration values cannot break out of shell commands through ${{ }} interpolation
• Improves compatibility and consistency by removing Unicode characters that may cause issues in CI systems or different terminal encodings
• Addresses SonarCloud security findings while documenting why certain patterns (pinned versions with Go checksum verification) are safe despite static analysis warnings

Testing Performed

• Automated file synchronization process validated syntax and structure of all modified YAML files
• GitHub Actions workflows should continue to function identically with the environment variable routing (behavioral equivalence maintained)
• Label file changes are purely cosmetic character replacements that don't affect label functionality

Impact / Risk

• Breaking Change: None - all changes are internal to CI/CD configuration with equivalent runtime behavior
• Security: Positive impact - reduces attack surface for potential injection vulnerabilities in GitHub Actions workflows
• Risk: Low - changes are defensive improvements to existing functionality with no behavioral modifications to application code

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Synchronizes CI/CD configuration from the upstream source repo, focusing on hardening GitHub Actions against injection risks and tightening permissions while keeping workflow behavior equivalent.

Changes:

• Routes workflow/action inputs through env: and hardens $GITHUB_ENV writes (base64 + validation) to reduce shell/jq injection and env-file injection risk.
• Refactors several workflows (labels/stale/coverage/release/dependabot/auto-merge) for safer token usage, clearer logging, and more restrictive permissions.
• Normalizes label descriptions to ASCII-safe characters and updates core env defaults (e.g., preferred token selection).

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/sync-labels.yml	Removes PAT-selection logging and standardizes token usage; adds summary sanitization for attacker-influenceable author fields.
.github/workflows/stale-check.yml	Simplifies token usage and removes PAT selection logic; preserves permissions for issue/PR operations.
.github/workflows/pull-request-management.yml	Updates checkout annotations and keeps security-critical sparse base-ref checkout.
.github/workflows/fortress.yml	Tightens secret routing and permissions across reusable workflow chain; adjusts coverage-related permissions.
.github/workflows/fortress-warm-cache.yml	Hardens $GITHUB_ENV writes when expanding env JSON.
.github/workflows/fortress-test-suite.yml	Adjusts reusable workflow secrets wiring and trims unused permissions.
.github/workflows/fortress-test-matrix.yml	Pins busybox placeholder image by digest for non-redis runs and documents rationale.
.github/workflows/fortress-setup-config.yml	Documents security invariant and hardens $GITHUB_ENV writes from env JSON.
.github/workflows/fortress-security-scans.yml	Updates gitleaks action pin and clarifies deprecation-warning expectations.
.github/workflows/fortress-release.yml	Routes refs/config through env: to avoid ${{ }} shell interpolation risks; improves release summary safety.
.github/workflows/fortress-pre-commit.yml	Adds checksum verification for downloaded assets; routes attacker-controlled outputs via env:.
.github/workflows/fortress-coverage.yml	Adds branch-name hard gate, provenance filtering for history ingestion, zip-slip guards, and tighter permissions.
.github/workflows/fortress-completion-report.yml	Hardens $GITHUB_ENV writes when expanding env JSON.
.github/workflows/fortress-benchmarks.yml	Pins busybox placeholder image by digest and hardens $GITHUB_ENV writes from env JSON.
.github/workflows/dependabot-auto-merge.yml	Reworks security classification to avoid PR-body escalation; strengthens env-routing and decision logic.
.github/workflows/auto-merge-on-approval.yml	Hardens fork handling and approval trust model; ensures token env is set for gh usage.
.github/labels.yml	Normalizes label descriptions to ASCII hyphens and <=.
.github/env/00-core.env	Switches preferred token selection default to GITHUB_TOKEN.
.github/actions/warm-redis-cache/action.yml	Uses per-run private scratch dir instead of predictable /tmp paths.
.github/actions/warm-cache/action.yml	Hardens $GITHUB_ENV writes from env JSON.
.github/actions/validate-test-results/action.yml	Adds coercion/sanitization to avoid arithmetic/markdown injection from artifact-derived data.
.github/actions/setup-mage/action.yml	Routes version via env: and documents SonarCloud false-positive handling for pinned go install.
.github/actions/setup-go-with-cache/action.yml	Clarifies security implications of writing tokens into global git config (job-lifetime).
.github/actions/setup-benchstat/action.yml	Routes version via env: and documents SonarCloud false-positive handling for pinned go install.
.github/actions/parse-env/action.yml	Documents security invariant and hardens $GITHUB_ENV writes from env JSON.
.github/actions/extract-module-dir/action.yml	Routes go-sum-file input via env: to avoid ${{ }} shell interpolation.
.github/actions/download-artifact-resilient/action.yml	Avoids bash -c on constructed commands and parameterizes jq regex usage.
.github/actions/configure-redis/action.yml	Routes env-json via env: to avoid single-quote breakout risk.

Suppressed comments (1)

.github/workflows/pull-request-management.yml:754

• The pinned SHA (3d3c42e5aac5ba805825da76410c181273ba90b1) does not match the inline version comment (v7.0.1). Update the comment to match the pinned SHA (or update the SHA to the intended release) so the workflow is self-describing for security review.

        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 — NOSONAR(S7631): base-ref sparse checkout only; PR head is never checked out or executed

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.