ci(docs-truth): load the verifier from trusted history, not the candidate tree (HELM-198)

[mindburnlabs]

Problem

.github/workflows/docs-truth.yml triggers on pull_request and resolves its reusable workflow through a local path, while handing it the org read token:

on:
  pull_request:
    branches: [main]
jobs:
  docs-truth:
    uses: ./.github/workflows/docs-truth-public.yml     # ← candidate tree
    secrets:
      MINDBURN_ORG_READ_TOKEN: ${{ secrets.PLATFORM_DESIGN_SYSTEM_REPO_READ_TOKEN }}

On a pull_request run, both the caller and a ./-resolved reusable workflow are read from the PR's merge tree. A branch PR can therefore rewrite docs-truth-public.yml inside the same PR that workflow is verifying, and secrets: hands the rewritten version a token scoped to check out every private repo the gate touches — Mindburn-Labs/<subject>, /.github, /docs, /dev-orchestration.

Reachability

• Not fork-reachable. GitHub withholds secrets from pull_request runs originating in a fork, so the token is empty there.
• Reachable by any principal that can push a branch to this repo — which on this org includes autonomous agents. That is privilege escalation from push a branch to .github to read every private repo in the org.

Fix

Pin the reusable workflow to a merged commit instead of ./.

The subject checkout inside the reusable still uses github.event.pull_request.head.sha, so the gate keeps verifying the PR's content — only the verifier itself now loads from trusted history.

Why this shape

Every other caller in the org already pins this workflow. .github was the last repo on the local path:

Repo	Pin
docs, helm-ai-kernel, docs_for_team	@3ce0af63
gitops-platform, helm-ai-enterprise	@f609d37a
mindburn-infra	@3a85cbbd
.github	./ — this PR

Cost

Changing docs-truth-public.yml now takes two PRs: land the change, then bump the pin. That is the intended trade, and it matches what every other repo already lives with.

Notes

• Containment PR fix(ci): contain Docs Truth PR credentials #46, referenced by HELM-198, never landed and does not appear in git log --all. The merged ADR d55c03d records that the containment PRs remained draft.
• Branch claude/docs-truth-token-guard (ci(docs-truth): fail fast when the org read token is missing or unscoped #55) is a different fix — it fails fast on a missing/unscoped token and leaves docs-truth.yml untouched. It does not overlap with this change.
• The PLATFORM_DESIGN_SYSTEM_REPO_READ_TOKEN → MINDBURN_ORG_READ_TOKEN mapping is the HELM-311 stopgap and is deliberately untouched here.

Found by a full 318-issue audit of the HELM AI Linear board against source-owned evidence. HELM-198 was reading as half-shipped because supporting probes and ADRs merged around it while the exposure itself went untouched.

Refs: HELM-198

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.