fix(ci): prevent untrusted review policy checkout

[rl-block]

Reviewable diff: +3/-1 across 1 file (excludes generated, test, and story files).

Summary

Closes the critical untrusted-checkout path in the privileged Review Policy workflow. Pull-request metadata can no longer select the policy code that executes with elevated workflow access; the checkout is fixed to the repository's trusted main branch.

Related: CodeQL untrusted-checkout alert 79

How it works

The workflow still resolves the pull request's base and head SHAs for identity checks and diff construction. Those values are now used only by later explicit fetch and diff commands; the executable policy checkout always comes from main, keeps credentials disabled, and retains full history for the three-dot diff.

The regression test enumerates every actions/checkout step in the privileged evaluation job. It requires exactly one checkout and verifies its literal ref, history depth, and credential settings, so a later PR-controlled checkout cannot silently replace the trusted workspace.

flowchart LR
    A["Privileged review-policy event"] --> B["Checkout trusted main"]
    B --> C["Execute review policy"]
    D["PR base and head SHAs"] --> E["Fetch commits for diff only"]
    E --> F["Read-only classifier"]
    C --> F

Loading

Areas of the code involved

Area / package / file	What changed	Why it matters for review
.github/workflows/review-policy.yml	Pins executable policy checkout to literal main	Security boundary that resolves CodeQL alert 79
.github/scripts/evaluate_review_policy_test.py	Enforces one trusted checkout and its safe inputs	Regression proof; the required Ruff hook also reformatted this touched test file

Key technical decisions & trade-offs

• Use literal main instead of a PR-derived base SHA so the privileged checkout cannot be tainted and static analysis can prove the trust boundary.
• Keep fetch-depth: 0 because later three-dot diff construction requires repository history.
• Do not set a dynamic repository: input; the checkout remains scoped to the current base repository.

Testing & validation

• python3 .github/scripts/evaluate_review_policy_test.py — 47 tests passed.
• Workflow YAML parsed successfully with Ruby.
• git diff --check, pre-commit Ruff, and pre-push hooks passed.
• Local zizmor was unavailable in the repository toolchain; GitHub CI is the authoritative workflow-security run.
• Alert closure requires the next CodeQL scan on main after merge.

Post-Deploy Monitoring & Validation

• Watch GitHub Actions for the next Review Policy run; search logs for Checkout trusted base policy and Using review policy code from the trusted base commit.
• Watch the repository Security dashboard for alert 79 to transition to fixed after the next default-branch CodeQL scan.
• Healthy signals: policy evaluation reaches the trusted-policy message, PR checks publish normally, and alert 79 closes.
• Failure signals: checkout cannot resolve main, policy evaluation stops before preflight, or alert 79 remains open after a fresh main scan. Revert this commit if Review Policy becomes unavailable; otherwise inspect the new CodeQL path before further changes.
• Validation window and owner: first CodeQL scan and first PR evaluation after merge; Proto Fleet maintainers.

---

[github-actions]

🔐 Codex Security Review

Note: This is an automated security-focused code review generated by Codex.
It should be used as a supplementary check alongside human review.
False positives are possible - use your judgment.

Scope summary

• Reviewed pull request diff only (a1e727eb7305583dd8ac48385c35a0c31ddf6fd1...b7f0d781ba4b793191eea6f8ec1f8bb851315311, exact PR three-dot diff)
• Model: gpt-5.6-sol

💡 Click "edited" above to see previous reviews for this PR.

---

Review Summary

Overall Risk: NONE

Findings

No security, correctness, or reliability findings in the reviewed diff.

Notes

The functional change pins privileged policy checkout to trusted main; remaining test changes are formatting plus a focused checkout-invariant test.

---

_{Generated by Codex Security Review |
Triggered by: @rl-block |
Review workflow run}