Repository navigation
Conversation
- Split CI workflow into fast feedback (automatic) and E2E tests (approval-gated) - External contributors get immediate lint/test/build feedback without secret exposure - Maintainers approve E2E tests via 'e2e-approved' label after code review - Trusted contributors (collaborators) retain automatic E2E test execution - Added comprehensive documentation for maintainers and contributors ci: add E2E approval workflow and documentation - Create .github/workflows/ci-e2e.yml with approval logic - Add .github/E2E_APPROVAL_GUIDE.md for maintainers - Add .github/E2E_APPROVAL_QUICKREF.md for quick reference - Add .github/workflows/README.md for workflow overview - Update CONTRIBUTING.md with new CI process - Modify .github/workflows/ci.yml to remove E2E tests docs: update contributor and maintainer documentation - Update CONTRIBUTING.md with two-tier CI explanation - Add deployment checklist and implementation summary to scratchpad - Create provisional change log in scratchpad security: prevent secret exposure to unreviewed external PRs - Tailscale secrets only accessible after maintainer approval - Clear audit trail via approval labels - Easy revocation if PR updated with suspicious code
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Provisional Change Log - CI Security Enhancement
Security Enhancement: Secure E2E Testing for Contributors
User Experience Impact
Technical Changes
Breaking Changes
Files Added
.github/workflows/ci-e2e.yml- E2E tests with approval logic.github/E2E_APPROVAL_GUIDE.md- Comprehensive maintainer guide.github/E2E_APPROVAL_QUICKREF.md- Quick reference for approvals.github/workflows/README.md- Workflow documentationscratchpad/ci-security-enhancement-summary.md- Implementation summaryscratchpad/ci-deployment-checklist.md- Deployment guideFiles Modified
.github/workflows/ci.yml- Removed E2E tests, kept fast feedback onlyCONTRIBUTING.md- Updated with new CI process and contributor guidanceSecurity Improvements
Migration Notes
e2e-approvedlabel required for approval processTesting Requirements
Change Type: Security Enhancement / CI Improvement
Impact Level: Medium (affects contributor workflow)
Risk Level: Low (backward compatible, opt-in security)
Testing Required: Yes (workflow testing, approval process)
Documentation Updated: Yes