harden: this workflow uses secrets: inherit to pass a... in...

[anupamme]

Summary

Harden input handling in workflow-templates/image-minimizer.yml (flagged by semgrep).

Vulnerability

Field	Value
ID	yaml.github-actions.security.secrets-inherit.secrets-inherit
Severity	HIGH
Scanner	semgrep
Rule	yaml.github-actions.security.secrets-inherit.secrets-inherit
File	workflow-templates/image-minimizer.yml:14
Assessment	Defensive hardening

Description: This workflow uses secrets: inherit to pass all of the calling workflow's secrets to a reusable workflow. This violates the principle of least privilege because the called workflow receives access to every secret in the repository, not just the ones it needs. If the called workflow is compromised or sourced from a third party, an attacker gains access to all repository secrets. Instead, explicitly pass only the secrets that the called workflow requires using the secrets: map, e.g. secrets: { MY_SECRET: ${{ secrets.MY_SECRET }} }.

Changes

• workflow-templates/image-minimizer.yml
• .github/workflows/image-minimizer.yml

Behavior Preservation

The change is scoped to 2 files on the vulnerable path; it only tightens handling of untrusted input and leaves valid inputs unaffected.

---

This patch removes an exploit primitive — a code pattern that, while not independently exploitable today, could be chained with other weaknesses by automated exploit-development tooling. Proactive removal of such primitives raises the bar against increasingly capable automated attack tools.

---

Automated security fix by OrbisAI Security

[fossifybot]

Fossify accepts code contributions only for open issues labeled help wanted. This pull request does not meet that requirement or one of the documented exceptions, so it is being closed without review. Please read the contribution guidelines before starting work.