fix(security): eliminate pwn-request checkout in review-bot privileged job

CodeQL flagged review-bot.yml (pull_request_target, App token minted) for
checking out untrusted code in a privileged context: the diff step did
`git fetch origin pull/<n>/head:pr-head` then diffed against it, pulling
attacker-controlled ref content into the runner's git state before the
critic gate ran.

Replace with an API-only diff: `gh pr diff <n>` piped directly into
critic_cli over stdin (--diff -). No git fetch/checkout of the PR head
occurs anywhere in the job; the only actions/checkout calls left are the
job's own base-ref self-checkout and a pinned, trusted autogen commit for
critic_cli. Also add fail-closed handling if `gh pr diff` itself errors,
so a failed API call can no longer be misread as "zero findings".

Ref: T-38-SEC-PWN

Author: Aitomates

.github/workflows/review-bot.yml

@@ -56,15 +56,16 @@ jobs:
           echo "PR is OUT-OF-CLASS. review-bot will not approve or merge. Falling back to human review."
 
       # --- Gate 2: deterministic critic (autogen critic_cli, pinned) ----
-      - name: Compute PR diff (base...head)
-        id: diff
-        if: steps.classify.outputs.eligible == 'true'
-        run: |
-          set -euo pipefail
-          git fetch origin "${{ github.event.pull_request.base.ref }}" --depth=100
-          git fetch origin "pull/${{ github.event.pull_request.number }}/head:pr-head" --depth=100
-          git diff "origin/${{ github.event.pull_request.base.ref }}...pr-head" > "${{ github.workspace }}/pr.diff"
-
+      # SECURITY (T-38-SEC-PWN / CodeQL actions/checkout-of-untrusted-code,
+      # PR #17 review-bot.yml lines 59-68): this job runs under
+      # pull_request_target with a minted App token, so the PR head is
+      # untrusted content in a privileged context. It MUST NOT be fetched,
+      # checked out, or merged into the local git object database here --
+      # not even via a bare `git fetch`. The diff is obtained exclusively
+      # through the GitHub API (`gh pr diff`, an authenticated HTTPS call
+      # that returns text, not a git ref) and streamed straight into
+      # critic_cli over stdin in the "Run critic_cli" step below. No PR-head
+      # commit ever touches this runner's filesystem or git state.
       - name: Checkout autogen (pinned commit, for critic_cli)
         if: steps.classify.outputs.eligible == 'true'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
@@ -86,19 +87,30 @@ jobs:
           echo "autogen checkout at the pinned critic_cli SHA failed -- treating as a hard stop (fail-closed). No approval will be issued." >&2
           exit 1
 
-      - name: Run critic_cli against PR diff
+      - name: Run critic_cli against PR diff (diff via API, no checkout of PR head)
         id: critic
         if: steps.classify.outputs.eligible == 'true'
         working-directory: autogen-critic
         env:
           PYTHONPATH: ${{ github.workspace }}/autogen-critic
+          # Read-only default token (permissions: contents: read, pull-requests:
+          # read) is sufficient for `gh pr diff`; the App token is intentionally
+          # NOT used here (least privilege -- this step never approves/merges).
+          GH_TOKEN: ${{ github.token }}
         run: |
           set -o pipefail
           python -m pip install --quiet -r requirements.txt
-          python -m maf_starter.critic_cli --diff "${{ github.workspace }}/pr.diff" --severity-gate blocking \
+          gh pr diff "${{ github.event.pull_request.number }}" --repo "${{ github.repository }}" \
+            | python -m maf_starter.critic_cli --diff - --severity-gate blocking \
             | tee "${{ github.workspace }}/critic-output.txt"
-          exit_code=${PIPESTATUS[0]}
-          echo "critic_exit=${exit_code}" >> "$GITHUB_OUTPUT"
+          diff_exit=${PIPESTATUS[0]}
+          critic_exit=${PIPESTATUS[1]}
+          if [ "${diff_exit}" -ne 0 ]; then
+            echo "gh pr diff failed (exit ${diff_exit}) -- treating as a hard stop (fail-closed). No approval will be issued." >&2
+            echo "critic_exit=1" >> "$GITHUB_OUTPUT"
+            exit 1
+          fi
+          echo "critic_exit=${critic_exit}" >> "$GITHUB_OUTPUT"
         continue-on-error: true
 
       - name: Request changes - critic findings block auto-merge

docs/security/T-38-SEC-PWN-review-bot-pwn-request-mitigation.md

@@ -0,0 +1,55 @@
+# T-38-SEC-PWN: review-bot pwn-request mitigation
+
+## Finding
+
+CodeQL (`actions/checkout-of-untrusted-code`, "Checkout of untrusted code in a
+privileged context") flagged `.github/workflows/review-bot.yml` on PR #17.
+The `review` job runs on `pull_request_target`, which mints a GitHub App
+installation token with `pull-requests: write` scope before the diff step
+ran. The prior "Compute PR diff (base...head)" step fetched the PR head ref
+directly (`git fetch origin pull/<n>/head:pr-head`) into the runner's local
+git object database and then diffed against it. Fetching attacker-controlled
+ref content into a privileged job's git state is the classic GitHub Actions
+pwn-request pattern (see GitHub's own docs on "Preventing pwn requests"),
+even though the original step never wrote that content to the working tree
+or executed it directly.
+
+## Mitigation
+
+The privileged `review` job is now checkout-free of any untrusted ref:
+
+- The eligibility classifier (`.github/scripts/classify-automerge-eligibility.ps1`)
+  already sourced its input exclusively from `gh pr view --json files,author`
+  (API text), not from any checked-out ref.
+- The diff step now calls `gh pr diff <n> --repo <repo>` (GitHub API over
+  HTTPS, returning diff text) and streams that text directly into
+  `critic_cli` over stdin (`--diff -`). No `git fetch`/`git checkout` of the
+  PR head, and no PR-head commit ever enters the runner's git object
+  database or filesystem.
+- The only `actions/checkout` calls remaining in the job are: (1) the job's
+  own repository at its default/base ref (never the PR head — no `ref:`
+  override is supplied, so under `pull_request_target` this resolves to the
+  base branch), and (2) `Coding-Autopilot-System/autogen` pinned to a fixed,
+  trusted commit SHA for `critic_cli`. Neither checks out attacker-controlled
+  content.
+- Added fail-closed handling: if `gh pr diff` itself fails (non-zero exit),
+  the job now hard-stops rather than silently treating an empty/partial diff
+  as "no findings" and proceeding toward approval.
+
+## Verification
+
+- Structural check: `grep` confirms zero occurrences of `git fetch .*pull/`,
+  `pr-head`, or `actions/checkout` with a PR-head `ref:` in
+  `.github/workflows/review-bot.yml`. The remaining `actions/checkout` uses
+  are the base-ref self-checkout and the pinned trusted `autogen` checkout.
+- The change was pushed to PR #17 (`feat/merge-flow-review-bot`); GitHub's
+  CodeQL check re-runs automatically on `synchronize` and is expected to
+  clear the "Checkout of untrusted code in a privileged context" alert on
+  the updated lines.
+
+## Note on scope
+
+This note was added directly to PR #17 rather than to PR #18, because PR #18
+("fix(release): resolve reusable workflow reference") is an unrelated
+release-engineering fix and does not contain a merge-flow threat table to
+update.