fix(security): pin workflow actions to SHA, clean up tempfile on failure

.github/workflows/pr-target-check.yml

@@ -13,7 +13,7 @@ jobs:
       github.event.pull_request.base.ref == 'master' &&
       github.event.pull_request.head.ref != 'develop'
     steps:
-      - uses: actions/create-github-app-token@v3
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         with:
           client-id: ${{ secrets.APP_CLIENT_ID }}
@@ -21,7 +21,7 @@ jobs:
           permission-pull-requests: write
 
       - name: Add wrong-base label and comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           github-token: ${{ steps.app-token.outputs.token }}
           script: |

scripts/benchmark-sessions/lib/runner.py

@@ -24,10 +24,14 @@ ROOT_DIR = Path(__file__).resolve().parent.parent
 def _create_tarball(source_dir: Path) -> str:
     fd, tarball = tempfile.mkstemp(suffix=".tar.gz")
     os.close(fd)
-    subprocess.run(
-        ["tar", "czf", tarball, "-C", str(source_dir), "."],
-        check=True,
-    )
+    try:
+        subprocess.run(
+            ["tar", "czf", tarball, "-C", str(source_dir), "."],
+            check=True,
+        )
+    except Exception:
+        Path(tarball).unlink(missing_ok=True)
+        raise
     return tarball
 
 
@@ -75,6 +79,7 @@ async def run_benchmark(
 
     total_steps = 5 if terminal_bench else 4
     vm_names: list[str] = []
+    local_tarball: str | None = None
 
     manifest = RunManifest(
         task_name=task.name,
@@ -88,7 +93,6 @@ async def run_benchmark(
         print(f"  VMs ready: {', '.join(vm_names)}")
 
         _print_step(2, total_steps, "Setting up codebases")
-        local_tarball = None
         if not task.codebase.is_github:
             local_tarball = _create_tarball(task.codebase.local_path())
 
@@ -149,6 +153,8 @@ async def run_benchmark(
         print(f"\n  Manifest written to {output_dir / 'manifest.json'}")
 
     finally:
+        if local_tarball:
+            Path(local_tarball).unlink(missing_ok=True)
         if not keep_vms and vm_names:
             print("\nCleaning up VMs...")
             await destroy_vm_pool(vm_names)