[Quim Muntal (qmuntal)]

Purpose

Follow up to #1309 by further narrowing the permissions and execution surface of automation reached through pull_request_target. The fork dispatcher remains a small trusted entry point, while the downstream API-consistency reviewer obtains evidence through GitHub APIs instead of checking out PR code or running native shell commands.

Changes

• Remove the fork dispatcher's unused contents: read permission; retain actions: write for dispatching the fixed review workflow.
• Disable agent checkout, bash, the shell-based CLI proxy, editing, and persistent cache memory. Explicitly deny Copilot's native shell and write tools, including automatically approved read-only shell commands.
• Remove the Go network ecosystem and require API evidence at the PR head SHA and specific upstream commits. Treat PR content as untrusted review data.
• Preserve existing trust guards, honest dispatch context, review criteria, and bounded comment/label safe outputs. GitHub token selection is intentionally unchanged; the proposed explicit GITHUB_TOKEN overrides are not included.
• Add a CodeQL Actions/none matrix leg alongside the existing Go/manual analysis. Go setup/build steps remain Go-only, and one matrix failure does not cancel the other leg.

Included gh-aw maintenance updates

• Pin the existing v0.92.0 setup/bootstrap actions to immutable SHAs and refresh matching action metadata and skill references.
• The regenerated weekly auto-upgrade schedule moves from Friday 03:21 UTC to Tuesday 10:19 UTC.

Trade-offs

• Reviews cannot run local builds, tests, or shell-based investigations. API limitations must be reported rather than treated as evidence of parity.
• No persistent cross-run review memory; repeated evidence gathering may require more API calls.
• The additional Actions CodeQL leg adds CI work while retaining Go analysis.
• This narrows the privileged fork-review path; it does not remove pull_request_target or weaken checkout trust checks to bypass the previous checkout failure.

Validation

• gh aw compile go-api-consistency-review --strict --validate --no-check-update: passed with zero warnings.
• gh aw list --json: all five authored/generated workflow pairs are synchronized.
• actionlint v1.7.12: passed for CodeQL, the fork dispatcher, Copilot setup, and auto-upgrade workflow YAML.
• Focused static contracts checked CodeQL matrix/build isolation and preservation of triggers, permissions, action pins, and analysis categories.
• Confirmed the token rollback restored the exact previously reviewed source/lock content and the retained CodeQL content matches its validated hash.
• No hosted workflow was manually dispatched.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

🔵 Needs a closer look

The privileged review path needs human validation of runtime tool restrictions and end-to-end safe-output behavior.

No open issues 🎉

What changed in this PR

Continues #1309’s automation hardening by making API-consistency reviews API-only and adding GitHub Actions security scanning.

Changes:

• Restrict reviewer tools, checkout, network access, and persistent memory; reduce dispatcher permissions.
• Add Actions CodeQL analysis alongside independent Go analysis.
• Pin gh-aw setup actions and refresh generated metadata, skill references, and the upgrade schedule.

File	Description
.github/​workflows/​symbolmap-maintenance-weekly.lock.yml	Normalize action version metadata and comments.
.github/​workflows/​go-api-consistency-review.md	Define API-only review restrictions and evidence requirements.
.github/​workflows/​go-api-consistency-review.lock.yml	Regenerate restricted reviewer execution.
.github/​workflows/​go-api-consistency-review-forks.yml	Remove unused contents permission.
.github/​workflows/​dotnet-port-fixes-nightly.lock.yml	Normalize action version metadata and comments.
.github/​workflows/​dotnet-port-api-nightly.lock.yml	Normalize action version metadata and comments.
.github/​workflows/​dotnet-code-portability-weekly.lock.yml	Normalize action version metadata and comments.
.github/​workflows/​copilot-setup-steps.yml	Pin setup action to an immutable SHA.
.github/​workflows/​codeql.yml	Add Actions analysis with isolated Go build steps.
.github/​workflows/​agentic-auto-upgrade.yml	Pin setup actions and change weekly schedule.
.github/​skills/​agentic-workflows/​SKILL.md	Add workflow guidance references.
.github/​aw/​actions-lock.json	Refresh action pins and version metadata.

_{Review effort: Balanced}