[mrz1836]

What Changed

• Updated label descriptions in .github/labels.yml to use simple hyphens instead of en-dashes (e.g., "201-500" instead of "201–500") and replaced "≤10" with "<=10" for ASCII compatibility
• Added comprehensive security documentation to .github/actions/parse-env/action.yml warning against using this action with privileged tokens on untrusted refs
• Hardened environment variable parsing in multiple GitHub Actions by base64-encoding values, validating variable names against strict patterns, and rejecting newline-bearing values to prevent $GITHUB_ENV corruption
• Updated GO_COVERAGE_VERSION from v1.11.0 to v1.12.2 in .github/env/00-core.env
• Added permissions: contents: read declarations to 13 workflow files (fortress-release.yml, dependabot-auto-merge.yml, fortress-benchmarks.yml, fortress-security-scans.yml, fortress-coverage.yml, fortress-pre-commit.yml, auto-merge-on-approval.yml, fortress-completion-report.yml, fortress-setup-config.yml, fortress-test-matrix.yml, fortress-warm-cache.yml, fortress-test-suite.yml, fortress.yml) following principle of least privilege
• Refactored several workflows to use environment variables instead of direct ${{ }} interpolation in shell contexts, routing untrusted values through env: blocks for safer handling
• Simplified stale-check.yml and sync-labels.yml by removing redundant permission grants and consolidating job configurations

Why It Was Necessary

• ASCII-only characters in label descriptions ensure compatibility across all platforms and avoid encoding issues in various tools and displays
• Security hardening prevents potential injection attacks where malicious PR content could corrupt GitHub environment files or execute arbitrary commands through specially-crafted variable values
• Explicit permission declarations implement security best practices by limiting workflow token capabilities to only what's required, reducing attack surface if workflows are compromised

Testing Performed

• Verified label synchronization workflows complete successfully with updated ASCII-only descriptions
• Validated that all GitHub Actions properly parse and set environment variables without corruption from special characters or newlines
• Confirmed workflow permission declarations do not break existing CI/CD pipeline functionality across all fortress workflows

Impact / Risk

• Low Risk: Changes are primarily defensive security improvements and cosmetic label updates that maintain backward compatibility
• No Breaking Changes: Workflow behavior remains functionally identical; only security posture and character encoding are improved
• Improved Security: Reduced risk of environment variable injection attacks and limited potential damage from compromised workflow runs through principle of least privilege

[mrz1836]

LGTM!