Harden update-search workflow to prevent GitHub App token leakage

[VatsalSy]

Motivation

• A workflow step created a GitHub App token before actions/checkout and relied on the checkout to persist credentials, which allowed a malicious symlinked search_db.json from an external repo to dereference and leak the token into a committed file.
• The change closes this credential-exposure path by ensuring the short-lived App token is not persisted and the imported file is validated before copying.

Description

• Disable credential persistence by adding persist-credentials: false to the actions/checkout step.
• Validate the imported file by checking it exists with test -f, asserting it is not a symlink with test ! -L, and confirming it is valid JSON with jq empty before copying.
• Use cp --no-dereference to avoid following symlinks when copying comphy-search/search_db.json into assets/js/search_db.json.
• Push using an explicit HTTPS URL containing the short-lived App token at push time (https://x-access-token:${APP_TOKEN}@github.com/${GITHUB_REPOSITORY}.git) instead of relying on credentials persisted by checkout.

Testing

• Ran repository linters with ./scripts/lint-check.sh and the script completed successfully.
• Performed a local symlink-regression simulation (creating a symlinked search_db.json and confirming the workflow steps block the copy); the simulation output showed the symlinked file was blocked.

---

Codex Task

[Copilot]

Pull request overview

This PR hardens the scheduled “update-search” GitHub Actions workflow for the Jekyll site by eliminating a credential-persistence path and adding defensive checks to prevent symlink-based token exfiltration when importing search_db.json from the external comphy-search repository.

Changes:

• Disable persisted git credentials during checkout (persist-credentials: false) to avoid leaving the GitHub App token in the repo’s git config.
• Validate the imported comphy-search/search_db.json (exists, not a symlink, valid JSON via jq empty) before copying.
• Push via an explicit HTTPS URL containing the short-lived App token at push-time instead of relying on checkout-persisted credentials.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.