what

• add persist-credentials: false to every actions/checkout call so the default GITHUB_TOKEN is not persisted into .git/config (artipacked). duty-scheduler.yaml now pushes via an explicit https://x-access-token:${GH_TOKEN}@github.com/${REPOSITORY} URL instead of relying on persisted creds.
• restructure quantitative.yaml to the safe two-workflow pattern. the test job now runs on pull_request (no secrets, read-only token, fork-safe) and writes pr_comment.md + a regex-validated pr_number.txt to an artifact. a new quantitative-comment.yaml triggers on workflow_run with pull-requests: write, downloads the artifact, and upserts the PR comment via gh api (marker <!-- quantitative-tests-comment -->). this eliminates the pull_request_target + PR-head checkout pwn-request antipattern (dangerous-triggers) and also drops the thollander/actions-comment-pull-request third-party dependency.
• matrix values in the test step moved to env: to avoid ${{ ... }} interpolation inside run: bodies.
• new .github/zizmor.yml ignores the remaining safe findings with justification:
  • check-pr-dependencies.yaml, check-pr-title.yaml — pull_request_target is the standard pattern here; neither workflow checks out PR code, both consume only PR metadata via pinned actions with pull-requests: read.
  • quantitative-comment.yaml — workflow_run is the privileged half of the safe pattern; it consumes only artifact contents (markdown + numeric PR id) and never executes PR-supplied code.

why

zizmor flagged 8 findings on this repo's workflows: 3 high-severity dangerous-triggers (pull_request_target) and 5 artipacked warnings. the quantitative.yaml finding is genuinely exploitable — pull_request_target runs with the base repo's secrets and pull-requests: write, and the workflow then checks out ${{ github.event.pull_request.head.sha }} and operates on PR-controlled files. switching to the pull_request + workflow_run pattern keeps the same UX (a PR comment with the false-positive diff) while removing fork code from any privileged context.

after the changes, zizmor reports: No findings to report. Good job! (3 ignored, 35 suppressed).

refs

• zizmor — https://docs.zizmor.sh/audits/
• GitHub Security Lab "preventing pwn requests" — https://securitylab.github.com/research/github-actions-preventing-pwn-requests/

ai disclosure

• tools used: Claude (Opus 4.7, 1M context) via Claude Code
• assisted with: running zizmor on .github/workflows/, drafting the safe two-workflow split for quantitative.yaml, writing .github/zizmor.yml with per-rule justifications, replacing thollander/actions-comment-pull-request with a gh api-based marker upsert, looking up the actions/[email protected] SHA via the GitHub API for pinning, drafting this PR description.
• review performed: re-ran zizmor .github/workflows/ after each change and confirmed final state is clean (3 ignored, 35 suppressed); ran actionlint on all workflow files (no new findings introduced by these changes); confirmed all actions/download-artifact and actions/checkout SHAs match the documented tags; manually traced the pull_request → workflow_run data flow to confirm no PR-controlled code executes in the privileged half and that the pr_number.txt artifact is regex-validated (^[0-9]+$) before use in gh api paths.