fix(ci): harden Infisical secret sync - #331
Draft
KooshaPari wants to merge 3 commits into
Draft
Conversation
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Legacy Tooling Scan Report
No violations detected. This is a WARN-mode scan. Fix before strict enforcement begins. |
📊 Tier-2 Coverage Gate Results
|
|
Legacy Tooling Scan Report
No violations detected. This is a WARN-mode scan. Fix before strict enforcement begins. |
📊 Tier-2 Coverage Gate Results
|
|
Legacy Tooling Scan Report
No violations detected. This is a WARN-mode scan. Fix before strict enforcement begins. |
|
📊 Tier-2 Coverage Gate Results
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Harden the Infisical workflow stacked on BytePort PR #326 (base head 236a881).\n\nChanges:\n- remove pull_request secret execution; permit only trusted push, manual, and reusable-workflow events\n- set contents: read at workflow and job scope\n- inject secrets only into a short-lived validation process without environment logging\n- remove the debug artifact path\n\nValidation: git diff --check passed. actionlint reports only the existing custom runner label blacksmith-2vcpu-ubuntu-2204 as unknown; no workflow syntax or expression errors reported.\n\nNo runtime requests, secret values, merge, tag, or release performed.