docs(rules): flag GitHub Actions template injection in agent rules (EXSC-578)

[0xDEnYO]

Which Linear task belongs to this PR?

Ref EXSC-578

Partial — this PR delivers the "add an AI-rule to catch it" half of EXSC-578 (the Ref keyword intentionally does not auto-close the ticket, since the PR #1984 review/merge half is tracked separately).

Why did I implement it this way?

Follow-up to PR #1984, which fixed the last direct ${{ github.* }} interpolations inside run: scripts in protectAuditLabels.yml. To stop this class of GitHub Actions template-injection bug from being reintroduced, this adds a [CONV:ACTIONS-NO-INJECTION] convention to the existing 500-github-actions.md rule rather than a new rule file — that rule is already scoped to .github/workflows/**, so the guidance activates exactly when an agent edits a workflow (satisfying both of the ticket's AI-rule checkboxes). The convention states the rule (never interpolate untrusted ${{ ... }} into a run: body), names the highest-risk attacker-controllable contexts (github.actor, github.head_ref, every github.event.* field), gives the correct env:-binding pattern plus the forbidden anti-pattern mirroring the #1984 fix, and clarifies that interpolation inside if:/with:/env: is safe — only the run: script body is the injection sink.

Checklist before requesting a review

• I have performed a self-review of my code
• This pull request is as small as possible and only tackles one problem
• I have added tests that cover the functionality / test the bug
• For new facets: I have checked all points from this list: https://www.notion.so/lifi/New-Facet-Contract-Checklist-157f0ff14ac78095a2b8f999d655622e
• I have updated any required documentation

Checklist for reviewer (DO NOT DEPLOY and contracts BEFORE CHECKING THIS!!!)

• I have checked that any arbitrary calls to external contracts are validated and or restricted
• I have checked that any privileged calls (i.e. storage modifications) are validated and or restricted
• I have ensured that any new contracts have had AT A MINIMUM 1 preliminary audit conducted on by <company/auditor>

[coderabbitai]

Warning

Review limit reached

@0xDEnYO, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 42 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: cdbfb9b2-c327-4f2b-bb6c-c4ee51f4905c

📥 Commits

Reviewing files that changed from the base of the PR and between 4656a8a and c576c46.

📒 Files selected for processing (1)

• .agents/rules/500-github-actions.md

Walkthrough

Adds a GitHub Actions security rule covering direct expression interpolation in run: scripts, high-risk GitHub contexts, safe env: usage, and expression boundaries outside shell scripts.

Changes

GitHub Actions security guidance

Layer / File(s)	Summary
Run script injection rule .agents/rules/500-github-actions.md	Documents forbidden interpolation patterns, high-risk contexts, safe quoted shell variables via env:, and expression usage boundaries in if:, with:, and env: values.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly names the docs rule update and the GitHub Actions injection focus.
Description check	✅ Passed	The description fills the required task and rationale sections and includes the requested checklists, with minor items left unchecked.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch docs/exsc-578-gha-template-injection-rule

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agents/rules/500-github-actions.md:
- Line 43: Update the safety guidance in the Fix bullet to limit the claim to
contexts outside the direct run: injection sink. Clarify that if: cannot
reference secrets directly, while with: and env: are safe only when the
receiving action or shell treats their values as data; retain the recommendation
to bind values through env: and quote the shell variable in run:.
- Around line 47-52: Update the “Check for authorized actor” example to replace
the reserved GITHUB_ACTOR environment variable with a custom name such as
ACTOR_NAME, and use that same name in the shell condition while preserving the
github.actor expression binding.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 4e58affe-7524-4e45-946c-33af796f6320

📥 Commits

Reviewing files that changed from the base of the PR and between 7206885 and 33a996b.

📒 Files selected for processing (1)

• .agents/rules/500-github-actions.md

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.agents/rules/500-github-actions.md:
- Around line 47-51: Add shell: bash to the “Check for authorized actor” step so
its [[ ... ]] conditional executes consistently on all runners, including
Windows; keep the existing authorization logic unchanged.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 03653e6c-9ee2-4ffb-8dc3-024870b1c3cd

📥 Commits

Reviewing files that changed from the base of the PR and between 33a996b and 4656a8a.

📒 Files selected for processing (1)

• .agents/rules/500-github-actions.md