From ff4496138b7bf556e156cecfdc77b045b31601ce Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 2 Aug 2026 19:46:57 -0700
Subject: [PATCH 1/3] fix(ci): harden Infisical secret sync workflow

---
 .github/workflows/infisical.yml | 27 +++++++++++++++------------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/infisical.yml b/.github/workflows/infisical.yml
index 582b0ab0..f2354a03 100644
--- a/.github/workflows/infisical.yml
+++ b/.github/workflows/infisical.yml
@@ -11,11 +11,21 @@ on:
     branches: [main, master]
     paths:
       - '.github/workflows/infisical.yml'
-  pull_request:
+
+# Secret-backed jobs must never run from untrusted pull-request code.
+permissions:
+  contents: read
 
 jobs:
   sync-secrets:
     name: Pull secrets from Infisical
+    if: >-
+      github.event_name == 'workflow_call' ||
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'push' &&
+      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'))
+    permissions:
+      contents: read
     runs-on: blacksmith-2vcpu-ubuntu-2204
     timeout-minutes: 5
     steps:
@@ -27,7 +37,7 @@ jobs:
           curl -1sLf "https://dl.cloudsmith.io/public/infisical/infisical-cli/setup.deb.sh" | sudo -E bash
           sudo apt-get install -y infisical
 
-      - name: Pull secrets to .env
+      - name: Validate Infisical access without exposing values
         env:
           INFISICAL_TOKEN: ${{ secrets.INFISICAL_TOKEN }}
           INFISICAL_PROJECT_ID: ${{ vars.INFISICAL_PROJECT_ID || secrets.INFISICAL_PROJECT_ID || '8efe392e-56a6-4c3c-89f9-8141183dd7e8' }}
@@ -43,17 +53,10 @@ jobs:
             exit 1
           fi
 
-          # Pull all secrets from the configured env into .env
+          # Inject secrets only into this short-lived child process. Do not
+          # write a local secrets file or print the resulting environment.
           infisical run \
             --projectId "$INFISICAL_PROJECT_ID" \
             --env "$INFISICAL_ENV" \
             --token "$INFISICAL_TOKEN" \
-            -- bash -c 'echo "Secrets loaded into env successfully" && env | grep -E "^[A-Z_]+=" | grep -v -E "^(PATH|HOME|PWD|SHELL|HOSTNAME|TERM|GITHUB_|RUNNER_|CARGO_|DEPLOY_|INPUT_|IMAGE_|ACTIONS_|STEP_|BOOT_|GRUB_|LS_COLORS|INVOCATION_ID|JOURNAL_)" | head -20'
-
-      - name: Upload secrets as artifact (debug only, never published)
-        if: failure()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-        with:
-          name: infisical-debug
-          path: .env
-          retention-days: 1
+            -- bash -c 'printf "%s\\n" "Infisical secrets loaded successfully"'

From 6ea5cda3ee072a7f617395da6c472e44cf83642a Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 2 Aug 2026 20:08:21 -0700
Subject: [PATCH 2/3] fix(ci): normalize Infisical workflow guard

---
 .github/workflows/infisical.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/infisical.yml b/.github/workflows/infisical.yml
index f2354a03..215f9e9c 100644
--- a/.github/workflows/infisical.yml
+++ b/.github/workflows/infisical.yml
@@ -19,11 +19,11 @@ permissions:
 jobs:
   sync-secrets:
     name: Pull secrets from Infisical
+    # A reusable caller must also be trusted; never pull credentials for a
+    # pull_request context, even if another workflow invokes this one.
     if: >-
-      github.event_name == 'workflow_call' ||
-      github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'push' &&
-      (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/master'))
+      github.event_name != 'pull_request' &&
+      github.event_name != 'pull_request_target'
     permissions:
       contents: read
     runs-on: blacksmith-2vcpu-ubuntu-2204

From 3b37aee45cf3a0ba397300e14cab713299dc5276 Mon Sep 17 00:00:00 2001
From: KooshaPari <kooshapari@gmail.com>
Date: Sun, 2 Aug 2026 20:24:36 -0700
Subject: [PATCH 3/3] style(ci): apply Prettier to Infisical workflow

---
 .github/workflows/infisical.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/infisical.yml b/.github/workflows/infisical.yml
index 215f9e9c..91960d30 100644
--- a/.github/workflows/infisical.yml
+++ b/.github/workflows/infisical.yml
@@ -10,7 +10,7 @@ on:
   push:
     branches: [main, master]
     paths:
-      - '.github/workflows/infisical.yml'
+      - ".github/workflows/infisical.yml"
 
 # Secret-backed jobs must never run from untrusted pull-request code.
 permissions: