mirror of
https://github.com/VibedByKaKi/t3-code-android-nightly.git
synced 2026-10-11 21:01:16 +02:00
20 lines
1 KiB
Markdown
20 lines
1 KiB
Markdown
# Privileged Workflows
|
|
|
|
- Privileged jobs must not run untrusted repository code with secrets or write
|
|
credentials.
|
|
- Validate cross-run data for expected source, identity, type, shape, and
|
|
bounded size before using it in commands, outputs, APIs, or comments.
|
|
- Require the intended approval boundary before fork-originated work reaches
|
|
privileged execution.
|
|
- Preserve publication and other irreversible operations until completion;
|
|
cancel only replaceable checks and previews.
|
|
- Make checkout revision and credential persistence explicit. Account for
|
|
every write permission and credential.
|
|
|
|
Search current workflows by event, job purpose, action, and permission to find
|
|
the nearest precedent for fork approval gates, publication, non-cancelable
|
|
concurrency, and validation of cross-run artifacts before privileged use.
|
|
|
|
Consult current GitHub documentation for event, token, secret, permission,
|
|
checkout, artifact, reusable-workflow, and environment semantics. Start with
|
|
the workflow events, workflow syntax, and secure-use references.
|