fix(ci): stop checking out event-controlled refs in privileged workflows

[FelixTJDietrich]

What changed and why

OpenSSF Scorecard's Dangerous-Workflow check flagged three places where a privileged workflow checked out a ref taken from its own triggering event (1155, 1156, 1157). Under pull_request_target and workflow_run the job carries the base repository's token, so that pattern is the classic "pwn request" shape, whether or not the surrounding guards happen to make it safe today.

• openapi-autocommit.yml now runs on pull_request instead of pull_request_target. The workflow already refused forks, so the privileged trigger bought nothing and only exposed the base branch's cache scope to the build it runs. The three-job split stays: the job that runs Maven and the OpenAPI generators holds no write token, and the job that pushes runs nothing from the checkout.
• release.yml checks out main and, before reading anything from the commit CI/CD built, proves that commit is an ancestor of origin/main. A force-pushed or foreign commit now fails the job instead of being released. Both credential-holding checkouts in the file drop persist-credentials.
• scripts/ci-contract.test.ts gains one test that mirrors Scorecard's rule, so a regression fails on the pull request rather than in the weekly scan after merge, and that pins the release guard the other release jobs depend on.

Follow-up to #1736, which covered the top-level permissions and Maven wrapper findings from the same scan.

How to test

CI covers the workflows: actionlint, zizmor and pnpm run test:tooling all pass locally on this branch. The new test was checked both ways: restoring the old head_sha checkout fails it, and removing the ancestry guard fails it.

After merge, add the autocommit-openapi label to a same-repository pull request. The API workflow should run on the pull_request event and push the regenerated spec and client to the branch as before.

Release impact

None. Only workflows and a repository test change, none of which ship in an image, so verify-changesets does not ask for a changeset and operators have nothing to do.

Notes for reviewers

• Scorecard runs on pushes to main, so the three alerts close on the first scan after merge, not on this pull request.
• Alongside this branch I cleaned up the code scanning view directly, which is worth knowing when you look at it: I deleted the five retired analysis categories (the old security-scan/* and trivy-image-* uploads that no workflow produces any more, whose 240 alerts pointed at files or image digests that no longer exist), and I dismissed CodeQL alert 1103 with the same justification the earlier stateless-chain dismissals used. Neither is part of this diff.
• Start with release.yml: the one-line comment on the guard is the only prose added there, and the diff is easiest to follow from the checkout down.

Written by Claude Fable 5.1 in Claude Code.

Summary by CodeRabbit

• Bug Fixes
  • Improved release validation to ensure releases are built from commits included in the main branch.
  • Strengthened automated workflow safeguards around pull requests and release execution.
• Chores
  • Updated release automation to use the exact source commit and prevent unintended credential persistence.
  • Added automated checks to verify that workflow configurations follow these security and reliability requirements.

[github-actions]

Approved automatically: @FelixTJDietrich is listed in the REVIEW_POLICY_MAINTAINERS repository variable, which the repository treats as satisfying the review requirement. See the review policy in docs/contributor/ci-cd.mdx.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: bf24cd97-8bae-407a-b0ce-170dd1c9113e

📥 Commits

Reviewing files that changed from the base of the PR and between 050f391 and 332f111.

📒 Files selected for processing (3)

• .github/workflows/openapi-autocommit.yml
• .github/workflows/release.yml
• scripts/ci-contract.test.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates workflow triggers, checkout credentials, and release commit validation. It adds CI contract coverage for unsafe event-derived checkouts and verifies that release commits belong to origin/main.

Changes

Workflow security controls

Layer / File(s)	Summary
Restrict pull request generation and commit execution .github/workflows/openapi-autocommit.yml	The workflow uses pull_request, skips fork runs, and documents token and execution boundaries.
Validate release commit provenance .github/workflows/release.yml	Release jobs check out github.sha, disable persisted credentials, and reject commits outside origin/main.
Enforce workflow checkout contracts scripts/ci-contract.test.ts	The CI test rejects unsafe event-derived checkout references and verifies release ancestry validation.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 332f1

This change tightens privileged workflow checkout behavior and adds regression coverage; no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: preventing privileged CI workflows from checking out event-controlled refs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch code-scanning-renovate-remediation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

📚 Documentation Preview

Preview has been removed (PR closed)

[github-actions]

🧩 Storybook Preview

Preview has been removed (PR closed)