Potential fix for code scanning alert no. 265: Checkout of untrusted code in trusted context

[joel-rieke]

Potential fix for https://github.com/trimble-oss/go-mysql-server/security/code-scanning/265

General fix approach: avoid running potentially untrusted PR code while the job has contents: write and an elevated token. In this workflow, the risky part is the format job: it checks out the PR head with a token that can push, runs a repository script, and commits changes. To align better with best practices while preserving functionality, we should (a) avoid using a custom secret token and rely on the default GITHUB_TOKEN that is already scoped by GitHub, and (b) ensure we are not explicitly checking out the “untrusted” PR head with special privileges. Since this workflow already separates forked PRs via alt-verify, the simplest safe improvement within the shown snippet is to remove the use of secrets.REPO_ACCESS_TOKEN and the redundant explicit ref for the checkout in the privileged job.

Best concrete change with minimal functional impact:

• In the format job:
  • Keep the guard if: github.event.pull_request.head.repo.full_name == github.repository.
  • Change the actions/checkout@v3 step so it:
    • Uses the default GITHUB_TOKEN implicitly (by removing the token: override).
    • Relies on the default behavior for ref (which is the PR’s merge commit / event SHA), by removing the explicit ref: ${{ github.head_ref }}. This avoids explicitly pinning the checkout to the PR head ref while still working correctly for formatting and committing against the PR’s branch, since EndBug/add-and-commit will commit to the checked-out branch.
• No changes are necessary to the verify and alt-verify jobs regarding security; they already only read and verify formatting.

Concretely, in .github/workflows/format.yml, edit the checkout step in the format job to:

• Remove the entire with: block (lines 27–29).
• Leave the uses: actions/checkout@v3 line alone so that defaults apply.

No new imports or external methods are needed; this is purely a workflow configuration change.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.