[codex] Harden GitHub Actions permissions

[jbeckwith-oai]

Summary

Harden the GitHub Actions configuration based on the workflow security audit:

• Set explicit read-only default GITHUB_TOKEN permissions for CI.
• Remove unnecessary checkout and contents: write from the release-creation dispatcher.
• Configure Stainless private-module git access through Git's GIT_CONFIG_* environment variables instead of writing credentials to runner home config.
• Pass branch-derived values through environment variables before shell use.
• Stop tracing artifact-upload commands and remove verbose curl output that could expose OIDC tokens or signed upload URLs.

Validation

• actionlint
• bash -n scripts/utils/upload-artifact.sh
• YAML parse check for all workflow/composite action files
• SHA-pin scan for external uses: references
• git diff --check
• Fake-token git rewrite probe for the GIT_CONFIG_* URL rewrite

Notes

All external GitHub Actions references remain pinned to full commit SHAs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 68b6fd4963

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[HAYDEN-OAI]

nice hardening pass. i checked the workflow trust boundaries, token scopes, stainless git runtime config, action sha pins, and the upload path; the earlier exact-200 issue is fixed at this head. looks good to me.