fix(ci): harden actions against pwn request vulnerabilities

[mjohns91]

Summary

• Upgrade actions/checkout v3→v7 and actions/setup-python v4→v7 to resolve Node 20 deprecation and enable built-in pwn request protection
• Move attacker-controllable inputs from direct ${{ }} shell interpolation to env: variables to prevent script injection
• Add persist-credentials: false to prevent token leakage via .git/config

Details

Applies security hardening patterns from the GitHub Security Lab blog post on preventing pwn requests to three files:

commit_to_pullrequest/action.yml

• Fixed github.head_ref script injection in git push command (attacker-controlled branch name)
• Fixed inputs.commit_message, inputs.file_pattern, inputs.python_libs, inputs.python_executable_url — all moved from direct shell interpolation to env vars
• Added persist-credentials: false and allow-unsafe-pr-checkout: true (required because this action legitimately checks out fork PR code to commit back)

ansible_validate_changelog/action.yml

• Fixed inputs.base_ref and inputs.custom_paths injection — moved from direct shell interpolation to env vars

workflows/changelog.yml

• Added persist-credentials: false to checkout step

No breaking changes

The inputs: interface for all actions/workflows is unchanged. Callers require no modifications.

Test plan

• Pre-commit hooks pass
• Existing pytest suite passes
• Verified no attacker-controllable ${{ }} expressions remain in run: steps
• Verify update_aws_variables workflow succeeds on a test PR in amazon.aws

🤖 Generated with Claude Code