tiennm99/ccs
1
0
Fork 0
mirror of https://github.com/tiennm99/ccs.git synced 2026-09-10 06:20:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): harden self-hosted workflow trust boundaries

Browse Source 
Keep active CCS workflows on self-hosted runners, gate self-hosted PR execution to trusted authors, and scope privileged release credentials to the exact git operations that need them.
This commit is contained in:
Kai (Tam Nhu) Tran
2026-05-12 12:34:15 -04:00
committed by GitHub
parent d86032ed0a
commit 2273757c83
17 changed files with 210 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/unit/scripts/github/ci-workflow.test.ts
+3
View File
@@ -9,6 +9,8 @@ function resolvePath(relativePath: string) {
describe('pr ci workflow', () => {
test('keeps full coverage on pull requests', () => {
const workflowPath = resolvePath('../../../../.github/workflows/ci.yml');
const trustedAuthorGate =
'contains(fromJSON(\'["COLLABORATOR","MEMBER","OWNER"]\'), github.event.pull_request.author_association)';
expect(fs.existsSync(workflowPath)).toBe(true);
@@ -17,6 +19,7 @@ describe('pr ci workflow', () => {
expect(workflow).toContain('name: CI');
expect(workflow).toContain('pull_request:');
expect(workflow).toContain('branches: [main, dev]');
expect(workflow.split(trustedAuthorGate).length - 1).toBe(3);
expect(workflow).toContain('group: ci-${{ github.ref }}');
expect(workflow).toContain('cancel-in-progress: true');
expect(workflow).toContain('fail-fast: false');