vale-autofix-rework

[jth-nw]

No description provided.

In general, the fix is to avoid performing privileged operations (using powerful tokens or broad write permissions) directly on untrusted PR code. For this workflow, we should remove the use of the personal access token (PAT) for checking out PR code and instead use the default GITHUB_TOKEN with the minimum required permissions. This keeps the PR checkout unprivileged while still letting the workflow commit and push changes when safe. If interaction with forks is undesired, we can also guard write operations with conditions that only allow them on same-repository PRs, but that change goes beyond what’s needed to address the flagged issue.

The minimal change that preserves existing functionality is to delete the token: ${{ secrets.PAT_TOKEN }} line in the checkout step, allowing actions/checkout@v4 to fall back to GITHUB_TOKEN. GITHUB_TOKEN is automatically provided and already governed by the permissions block (contents: write, pull-requests: write), so this should still allow the workflow to push auto-fix commits and update PRs, but removes the explicit use of a potentially over-scoped secret for untrusted code. All other logic (Vale download, file detection, auto-fix/commit steps) remains unchanged.

Concretely, in .github/workflows/vale-autofix.yml at the “Checkout PR branch” step, remove the token: line and keep ref: and fetch-depth: as-is. No additional imports, methods, or definitions are required.