streamline some github actions (#7430)

Co-authored-by: Douwe Osinga <douwe@squareup.com>

.github/workflows/pr-comment-build-cli.yml

@@ -1,4 +1,8 @@
 # This workflow is triggered by a comment on PR with the text ".build-cli"
+#
+# SECURITY: This workflow checks out and builds code from PRs. To prevent
+# malicious code execution (GHSA-4h72-4h3w-4587, GHSA-mqm8-hhf6-wvjq),
+# we verify the commenter has write access before proceeding.
 on:
   issue_comment:
     types: [created]
@@ -28,11 +32,56 @@ jobs:
     name: Trigger on ".build-cli" PR comment
     runs-on: ubuntu-latest
     outputs:
-      continue: 'true'
+      continue: ${{ steps.security_check.outputs.authorized }}
       pr_number: ${{ steps.command.outputs.issue_number || github.event.inputs.pr_number }}
       head_sha: ${{ steps.set_head_sha.outputs.head_sha || github.sha }}
     steps:
+      # SECURITY: Verify commenter has write access BEFORE any checkout
+      # This prevents attackers from triggering builds on their own malicious PRs
+      - name: Verify commenter permissions
+        id: security_check
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # v8
+        with:
+          script: |
+            // workflow_dispatch requires repo write access, so it's inherently safe
+            if (context.eventName === 'workflow_dispatch') {
+              core.setOutput('authorized', 'true');
+              console.log('✅ workflow_dispatch - authorized');
+              return;
+            }
+            
+            const commenter = context.payload.comment.user.login;
+            console.log(`Checking permissions for: ${commenter}`);
+            
+            try {
+              const { data: permission } = await github.rest.repos.getCollaboratorPermissionLevel({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                username: commenter
+              });
+              
+              const allowed = ['admin', 'maintain', 'write'].includes(permission.permission);
+              console.log(`Permission level: ${permission.permission}, Authorized: ${allowed}`);
+              
+              if (!allowed) {
+                // Post a comment explaining the rejection
+                await github.rest.issues.createComment({
+                  owner: context.repo.owner,
+                  repo: context.repo.repo,
+                  issue_number: context.payload.issue.number,
+                  body: `⚠️ @${commenter} Only repository collaborators with write access can trigger builds.`
+                });
+                core.setOutput('authorized', 'false');
+              } else {
+                core.setOutput('authorized', 'true');
+              }
+            } catch (error) {
+              console.log(`Permission check failed: ${error.message}`);
+              core.setOutput('authorized', 'false');
+            }
+
       - name: Run command action
+        if: steps.security_check.outputs.authorized == 'true'
         uses: github/command@v2.0.3
         id: command
         with:
@@ -42,10 +91,12 @@ jobs:
           allowed_contexts: pull_request
 
       - name: Checkout code
+        if: steps.security_check.outputs.authorized == 'true'
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8  # v6.0.1
         
       - name: Get PR head SHA with gh
         id: set_head_sha
+        if: steps.security_check.outputs.authorized == 'true'
         run: |
           echo "Get PR head SHA with gh"
           HEAD_SHA=$(gh pr view "$ISSUE_NUMBER" --json headRefOid -q .headRefOid)
@@ -92,4 +143,4 @@ jobs:
             - [📦 Windows (x86_64)](https://nightly.link/${{ github.repository }}/actions/runs/${{ github.run_id }}/goose-x86_64-pc-windows-gnu.zip)
 
             These links are provided by nightly.link and will work even if you're not logged into GitHub.
-  
+