tiennm99/ccs
1
0 Fork 0
mirror of https://github.com/tiennm99/ccs.git synced 2026-10-15 04:18:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(ci): harden self-hosted workflow trust boundaries

Browse Source 
Keep active CCS workflows on self-hosted runners, gate self-hosted PR execution to trusted authors, and scope privileged release credentials to the exact git operations that need them.
This commit is contained in:
Kai (Tam Nhu) Tran authored and GitHub committed 2026-05-12 12:34:15 -04:00
1 parent d86032ed0a
commit 2273757c83
17 files changed
+210 -29
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

tests/unit/scripts/github/ai-review-workflow.test.ts
+9 -1
View File
@@ -7,7 +7,7 @@ function resolvePath(relativePath: string) {
}
describe('PR-Agent review lane migration', () => {
test('keeps ai-review.yml as the PR-Agent workflow on the self-hosted cliproxy runner', () => {
test('keeps ai-review.yml as the PR-Agent workflow on the self-hosted cliproxy runner with trusted PR gating', () => {
const workflowPath = resolvePath('../../../../.github/workflows/ai-review.yml');
const prAgentConfigPath = resolvePath('../../../../.pr_agent.toml');
@@ -23,6 +23,14 @@ describe('PR-Agent review lane migration', () => {
expect(workflow).toContain('uses: qodo-ai/pr-agent');
expect(appTokenUsages).toHaveLength(2);
expect(workflow).toContain('OPENAI.API_BASE');
expect(workflow).toContain("github.event_name == 'pull_request_target' &&");
expect(workflow).toContain(
'contains(fromJSON(\'["COLLABORATOR","MEMBER","OWNER"]\'), github.event.pull_request.author_association)'
);
expect(workflow).toContain(
'contains(fromJSON(\'["COLLABORATOR","MEMBER","OWNER"]\'), github.event.issue.author_association)'
);
expect(workflow).toContain('github.event.issue.author_association');
expect(workflow).toContain('OPENAI_KEY');
expect(workflow).toContain('vars.AI_REVIEW_BASE_URL');
expect(workflow).toContain('vars.AI_REVIEW_MODEL');