fix: security, CI, and quality issues across repo

[suhail-ak-2]

Summary

Comprehensive audit and fix of security, CI/CD, code quality, and documentation issues across the repository. 39 files changed covering 15 distinct issues.

---

🔴 Security Fixes

1. JSON injection in log-issue-events.yml

The Statsig logging workflow constructed JSON via shell string interpolation, which is vulnerable to injection via issue titles containing quotes/special characters. Replaced with jq -n for safe JSON construction.

2. Removed unnecessary id-token: write from claude.yml

The @claude mention workflow only needs read permissions. The id-token: write scope was unnecessary and could allow OIDC token generation.

3. Pinned all GitHub Actions to commit SHAs

6 workflows used unpinned tags (@v4, @v2, @v7, @v1) which are vulnerable to tag-repointing attacks. All actions are now pinned to immutable commit SHAs with version comments:

• actions/checkout → 34e114876b... # v4
• oven-sh/setup-bun → 3d267786b... # v2
• actions/github-script → f28e40c7f... # v7
• anthropics/claude-code-action → b35a222b7... # v1

---

🟠 CI/Workflow Fixes

4. Fixed invalid top-level description field in 3 workflows

auto-close-duplicates.yml, backfill-duplicate-comments.yml, and claude-dedupe-issues.yml had description: as a root-level key, which is not a valid GitHub Actions workflow field. Moved to comments.

5. Fixed event name mismatch in log-issue-events.yml

The workflow triggers on both opened and closed events but always logged github_issue_created. Now dynamically uses github_issue_opened or github_issue_closed based on the actual event action.

---

🟡 Code Quality Fixes

6. Made init-firewall.sh executable

Only .sh file in the repo missing the executable bit (was 644, all others are 755). The Dockerfile compensates with chmod +x, but source should be correct.

7. Standardized shebangs to #!/usr/bin/env bash

13 scripts used hardcoded #!/bin/bash; standardized to portable #!/usr/bin/env bash for compatibility with NixOS, non-standard containers, etc.

8. Fixed security_reminder_hook.py field name handling

extract_content_from_input() only checked new_string for Edit/MultiEdit tools. Now also checks new_text to avoid silently missing security patterns.

9. Added pagination to API calls in auto-close-duplicates.ts

Comments and reactions API calls had no per_page parameter, defaulting to GitHub's 30-item limit. Issues with 30+ comments could miss duplicate detection. Added per_page=100.

10. Added error messages to silent exits in gh.sh and edit-issue-labels.sh

Both scripts exited with code 1 on validation failures without any stderr output, making CI debugging very difficult. Added descriptive error messages for all failure paths.

---

🔵 Documentation Fixes

11. Normalized documentation URLs

Consolidated all docs.claude.com/en/docs/claude-code/... URLs to the canonical code.claude.com/docs/en/... domain used in the main README. Also fixed an outdated docs.anthropic.com URL in the hook example.

12. Fixed contradictory install instructions in plugins/README.md

Main README says npm install is deprecated, but plugins/README.md still recommended it. Updated to use the recommended curl / Homebrew methods.

13. Fixed typo in examples/settings/README.md

"Use these are starting points" → "Use these as starting points"

14. Expanded .gitignore

Was only .DS_Store. Added standard ignores for Node (node_modules/, dist/), Python (__pycache__/, *.pyc), environment files (.env), logs, and editor swap files.

---

Validation

All modified files pass syntax checks:

• ✅ All JSON files valid (python3 -m json.tool)
• ✅ All shell scripts valid (bash -n)
• ✅ All Python files valid (py_compile)