ci: replace local hidden-unicode lint with weaviate composite action

.github/workflows/pr-security-lint.yaml

@@ -1,27 +1,35 @@
 name: PR Security Lint
 
+# SECURITY: This workflow uses pull_request_target intentionally so that the
+# workflow definition runs from the BASE branch (main), not the PR. The
+# composite action it invokes lives at a pinned 40-char SHA in
+# weaviate/weaviate — attackers cannot alter the lint logic via a PR or by
+# tampering with an upstream tag.
+#
+# Rules:
+#   1. Do NOT add `ref: ${{ github.event.pull_request.head.sha }}` or any
+#      reference to PR-controlled refs. The composite uses the GitHub API to
+#      fetch the diff text — no PR code is ever executed.
+#   2. Do NOT add secrets to this workflow. The pull_request_target context
+#      grants a token with write access to the base repo and access to all
+#      repo secrets if any are referenced. We reference none and request
+#      minimal permissions; keep it that way.
+#   3. Keep the composite action pinned to a full-length commit SHA. Tag or
+#      branch refs would let an upstream change alter the lint logic at
+#      execution time.
 on:
   pull_request_target:
-    types: [opened, synchronize, reopened]
 
-# No permissions at workflow level — grant only what's needed at job level
 permissions: {}
 
 jobs:
-  hidden-unicode-check:
-    name: Check for hidden Unicode characters
+  hidden-unicode:
+    name: hidden unicode characters
     runs-on: ubuntu-latest
     permissions:
-      contents: read
-      pull-requests: read
+      pull-requests: read   # required by the composite's `gh pr diff` call
     steps:
-      - name: Checkout base branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: weaviate/weaviate/.github/actions/security-lint@3e52fc80a244f4644d4facc6a4e705ea6eda9039 # PR #11093
         with:
-          ref: ${{ github.event.pull_request.base.sha }}
-
-      - name: Check PR diff for hidden Unicode
-        env:
-          GH_TOKEN: ${{ github.token }}
-        run: |
-          gh pr diff ${{ github.event.pull_request.number }} | bash tools/linter_hidden_unicode.sh --stdin
+          pr-number: ${{ github.event.pull_request.number }}
+          github-token: ${{ github.token }}