ci: harden metadata release and triage workflow permissions

[twcclegg]

1. Script injection in finalize_metadata_release.yml (Scorecard: Dangerous-Workflow, critical)

The release step interpolated event data straight into a run: body:

run: |
  bash lib/finalize-metadata-release.sh \
    "${{ github.event.pull_request.head.ref }}" \
    "${{ github.event.pull_request.merge_commit_sha }}"

head.ref is attacker-supplied text, and the expression engine substitutes it before bash parses the line — so a branch name containing shell metacharacters executes as code, in a job holding contents: write and actions: write.

Both values now reach the step through env: and are referenced as quoted shell variables. The script receives the same two positional arguments in the same order.

The existing if: gates (merged PR, base main, metadata-update/* prefix, author libphonenumber-csharp-bot) made this hard to reach but did not remove it. They are unchanged.

2. Over-broad token permissions in triage_metadata_issues.yml (Scorecard: Token-Permissions, high)

The top-level block granted contents/issues/pull-requests/copilot-requests: write to every job in the file. Top level is now contents: read, with the four writes moved onto the single triage job that needs them, each commented with the step that requires it. No future job added to this file silently inherits write access.

Deliberately not changed: the two finalize_metadata_release.yml job permissions

Scorecard also flags contents: write (line 32) and actions: write (line 33) on that job. Both are the minimum for the flow, verified against lib/finalize-metadata-release.sh, lib/github-release-helpers.sh and publish_nuget.yml:

• contents: write — createRelease POSTs /repos/.../releases with target_commitish, which creates the vX.Y.Z tag as well as the release. There is no finer-grained release scope, and contents: read cannot create a ref.
• actions: write — dispatchPublish POSTs to /actions/workflows/publish_nuget.yml/dispatches, which requires it. The dispatch cannot be dropped: GitHub suppresses push events raised by GITHUB_TOKEN, so the tag created above will not fire publish_nuget.yml's push: tags: ['v*'] trigger on its own — which is what the # github suppresses push events from GITHUB_TOKEN comment in the helper records.

Both permissions now carry a comment naming the exact API call that needs them. Suggest dismissing those two alerts as used-as-designed rather than weakening the release path.

Verification

• Both files parse as YAML.
• Interpolation scan across every run: body in both files: the only remaining ${{ }} is ${{ runner.temp }}, which is runner-provided, not event-controlled. (actions/github-script script: blocks still use ${{ toJSON(...) }}, the correct JS-context-safe pattern — not a shell body.)
• Effective permissions after the change — finalize: top contents: read, job contents: write, actions: write; triage: top contents: read, job contents/issues/pull-requests/copilot-requests: write.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.51%. Comparing base (8ad7fa2) to head (9d71888).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #458   +/-   ##
=======================================
  Coverage   87.51%   87.51%           
=======================================
  Files          43       43           
  Lines        3886     3886           
  Branches      991      991           
=======================================
  Hits         3401     3401           
  Misses        280      280           
  Partials      205      205           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.