[Sync] Update project files from source repository (c939592)

[mrz1836]

What Changed

• Label descriptions: Replaced en-dashes and special characters with simple ASCII hyphens and <= operator in .github/labels.yml (size labels now use "201-500" instead of "201–500", "<=10" instead of "≤10")
• Security documentation: Added detailed security comment in setup-go-with-cache/action.yml explaining that git token configuration is deliberately job-lifetime scoped and is destroyed with the ephemeral runner
• Input sanitization: Routed benchstat-version through environment variable in setup-benchstat/action.yml to prevent command injection via GitHub Actions interpolation
• Environment variable handling: Added explicit environment variable routing and validation across multiple action files (extract-module-dir, configure-redis, parse-env, download-artifact-resilient, setup-mage, validate-test-results, warm-cache, warm-redis-cache) to prevent shell injection
• Version update: Updated MAGE_VERSION from v1.15.0 to v1.15.1 in .github/env/00-core.env
• Workflow hardening: Added explicit permissions: blocks with minimal required scopes across 15 workflow files, replacing implicit default permissions
• Code clarity: Enhanced comments and code structure in workflow files to improve maintainability and security posture

Why It Was Necessary

• Security hardening: Prevent potential command injection vulnerabilities by routing user-controlled inputs through environment variables rather than direct shell interpolation
• Principle of least privilege: Explicit permission declarations ensure workflows only have access to the minimum required GitHub API scopes
• Compliance and auditability: Enhanced documentation (especially around credential handling) provides clear security context for future maintainers and security reviews

Testing Performed

• Validated that workflow syntax changes maintain compatibility with GitHub Actions runtime
• Verified that ASCII character replacements in label descriptions render correctly in GitHub UI
• Confirmed that environment variable routing preserves functional behavior while improving security posture

Impact / Risk

• Breaking changes: None - changes are security-focused improvements to existing behavior
• Security improvement: Significantly reduces attack surface for command injection and token leakage scenarios
• Low risk: Changes are defensive in nature and maintain existing functional behavior while adding guardrails

[Copilot]

Pull request overview

Syncs workflow/action definitions from the source repository with a focus on security hardening: reducing shell interpolation risks, tightening default GitHub token usage, and applying least-privilege permissions across workflows.

Changes:

• Routed user-/PR-influenceable values through env: (and added validation/sanitization) to reduce shell/jq/markdown injection risk.
• Standardized token usage away from GH_PAT_TOKEN in several workflows and improved provenance/guardrails in automation logic.
• Hardened workflows with more explicit minimal permissions: and supply-chain safeguards (digest pins, checksum verification).

Reviewed changes

Copilot reviewed 28 out of 28 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/sync-labels.yml	Removes PAT-selection logic; uses GITHUB_TOKEN; sanitizes attacker-influenceable summary fields.
.github/workflows/stale-check.yml	Removes PAT-selection logic; uses GITHUB_TOKEN; simplifies token reporting.
.github/workflows/pull-request-management.yml	Updates checkout reference comment/version and maintains hardened base-ref sparse checkout.
.github/workflows/fortress.yml	Propagates token/permission tightening through the main CI orchestrator.
.github/workflows/fortress-warm-cache.yml	Hardens $GITHUB_ENV writes from JSON via base64 + key/value validation.
.github/workflows/fortress-test-suite.yml	Removes GH_PAT_TOKEN workflow secret; aligns secret passing to reusable workflows; adjusts perms.
.github/workflows/fortress-test-matrix.yml	Pins busybox to digest when Redis disabled; adds supply-chain rationale.
.github/workflows/fortress-setup-config.yml	Adds security invariant docs and hardens $GITHUB_ENV writes from JSON.
.github/workflows/fortress-security-scans.yml	Updates gitleaks action pin/commentary for upstream runtime warnings.
.github/workflows/fortress-release.yml	Routes tag/config values through env; validates tag; reduces shell interpolation.
.github/workflows/fortress-pre-commit.yml	Adds checksum verification for downloaded assets; routes PR-derived outputs via env.
.github/workflows/fortress-coverage.yml	Adds branch-name validation + provenance filtering; tightens permissions and env routing.
.github/workflows/fortress-completion-report.yml	Hardens $GITHUB_ENV writes from JSON via base64 + validation.
.github/workflows/fortress-benchmarks.yml	Pins busybox to digest when Redis disabled; hardens $GITHUB_ENV writes.
.github/workflows/dependabot-auto-merge.yml	Reworks “security update” detection to structured advisory matching; routes metadata via env.
.github/workflows/auto-merge-on-approval.yml	Ensures GITHUB_TOKEN available for gh usage; hardens fork handling and approval counting.
.github/labels.yml	Replaces special characters with ASCII equivalents in label descriptions.
.github/env/00-core.env	Switches preferred token config from GH_PAT_TOKEN to GITHUB_TOKEN.
.github/actions/warm-redis-cache/action.yml	Uses mktemp -d private scratch dir instead of predictable /tmp paths.
.github/actions/warm-cache/action.yml	Hardens $GITHUB_ENV writes from JSON via base64 + validation.
.github/actions/validate-test-results/action.yml	Adds integer coercion + markdown sanitization for artifact-derived values.
.github/actions/setup-mage/action.yml	Routes mage version via env to avoid interpolation in shell install command.
.github/actions/setup-go-with-cache/action.yml	Adds security documentation around job-lifetime git token configuration.
.github/actions/setup-benchstat/action.yml	Routes benchstat version via env to avoid interpolation in shell install command.
.github/actions/parse-env/action.yml	Hardens $GITHUB_ENV writes from JSON via base64 + validation; adds security invariant note.
.github/actions/extract-module-dir/action.yml	Routes go-sum-file input via env before shell usage.
.github/actions/download-artifact-resilient/action.yml	Removes bash -c command-string execution; parameterizes jq regex; uses env vars safely.
.github/actions/configure-redis/action.yml	Routes env-json via env to avoid single-quote breakout in shell.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mrz1836]

LGTM!