Security PoC (OSS VRP): no-op marker in dismiss_reviews.py - does not…

[v-yun]

Security research PoC - Google OSS VRP (authorized)

This PR demonstrates that any external contributor can execute
attacker-controlled code inside the privileged Checks (secure) workflow
(pull_request_target + permissions: write-all), because actions/checkout
checks out the PR merge ref and then runs scripts/gha/dismiss_reviews.py
from the PR with the job token in argv.

What this PR does (non-destructive):

• replaces scripts/gha/dismiss_reviews.py with a no-op marker that prints
  VRP-A3-MARKER-754219 and exits; it does NOT read/print/transmit the token
  and performs no network access.

POC_ID: VRP-A3-20260918
A full report is being submitted to bughunters.google.com. This PR will be
closed immediately after evidence capture.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request replaces the utility script scripts/gha/dismiss_reviews.py with a no-op security Proof of Concept (PoC) marker for the Google OSS VRP. The script is now inert, printing a marker message to demonstrate execution within a privileged workflow without utilizing or transmitting the provided token. There are no review comments, and we have no feedback to provide.

[v-yun]

Evidence captured - closing PoC.

Result: run https://github.com/firebase/firebase-cpp-sdk/actions/runs/35316570749 (Checks (secure), event=pull_request_target) executed ALL steps against this fork PR, including "Run actions/checkout" (PR merge ref), "Install prerequisites" and "Dismiss reviews" -- the last one ran the PR-controlled scripts/gha/dismiss_reviews.py with the job's GITHUB_TOKEN (permissions: write-all at workflow level) in argv, and succeeded.

No credentials were read, printed, or transmitted; no API calls were made by the PoC script; no external network access. Full report being submitted to Google OSS VRP (bughunters). POC_ID: VRP-A3-20260918