sixfold-space/madtea
sixfold-space/madtea
SHA256
2
0
Fork 0
Code Issues 220 Pull requests Projects Releases 14 Packages Wiki Activity Actions 1

docs(adr): record the fork-PR CI trust model (0035) #489

Merged
hexajon merged 1 commit from issue-415-fork-pr-ci-trust-adr into main 2026-09-14 21:07:20 +00:00
Conversation 0 Commits 1 Files changed 2 +122
hexajon commented 2026-09-14 21:07:18 +00:00
Owner
Copy link

Summary

Records the fork-PR CI decision as ADR 0035.

  • Anyone can read the repository without an account. Only trusted people have an account, and every account is one I created. Self-registration is off, and the one sign-in provider offers no registration.
  • Forking, opening a pull request and starting a workflow all need an account, so no anonymous visitor can run code on the runner. A fork or first-time-contributor approval gate would only repeat that account gate, so I do not turn one on.
  • Runner isolation stays as a second layer: no host docker socket, unprivileged containers, allowlisted volumes, and default-reject egress to private networks. The workflows use plain pull_request, no pull_request_target or workflow_run, and no third-party actions. The socket-privileged smoke job never runs on a pull request.
  • The record names the condition to revisit: if registration ever opens, the approval gate becomes required.

Checked 2026-09-14: the signup page, the sign-in provider, anonymous read of the repo page, and the workflow files. adr check passes.

Closes #415.

Closes #415

## Summary Records the fork-PR CI decision as ADR 0035. - Anyone can read the repository without an account. Only trusted people have an account, and every account is one I created. Self-registration is off, and the one sign-in provider offers no registration. - Forking, opening a pull request and starting a workflow all need an account, so no anonymous visitor can run code on the runner. A fork or first-time-contributor approval gate would only repeat that account gate, so I do not turn one on. - Runner isolation stays as a second layer: no host docker socket, unprivileged containers, allowlisted volumes, and default-reject egress to private networks. The workflows use plain `pull_request`, no `pull_request_target` or `workflow_run`, and no third-party actions. The socket-privileged smoke job never runs on a pull request. - The record names the condition to revisit: if registration ever opens, the approval gate becomes required. Checked 2026-09-14: the signup page, the sign-in provider, anonymous read of the repo page, and the workflow files. `adr check` passes. Closes #415. Closes #415
docs(adr): record the fork-PR CI trust model (0035)
Some checks failed
drift / govulncheck (pull_request) Has been skipped
Details
drift / surface-diff (pull_request) Successful in 1m6s
Details
drift / forgejo-smoke (pull_request) Has been skipped
Details
ci / gate (push) Failing after 17m11s
Details
ci / mcp-conformance (pull_request) Failing after 18m29s
Details
ci / gate (pull_request) Failing after 18m29s
Details
drift / govulncheck (push) Has been skipped
Details
drift / forgejo-smoke (push) Has been skipped
Details
drift / surface-diff (push) Successful in 11s
Details
ci / mcp-conformance (push) Successful in 32s
Details
5a89e5fc95
 
Closes #415
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
breaking
Breaking change - flag for release notes

  
bug
Something is not working

  
documentation
Documentation only

  
enhancement
New feature

  
epic
Tracking epic with dependency children

  
good first issue
Interested in contributing? Get started here.

  
help wanted
Maintainer would welcome outside help

  
refactoring
Code restructuring without behavior changes

  
resolution/duplicate
Closed as duplicate of another issue

  
resolution/invalid
Closed as invalid or not reproducible

  
resolution/wontfix
Closed as won't fix

  
security
Security issue or hardening

  
severity/critical
Security severity: critical

  
severity/high
Security severity: high

  
severity/low
Security severity: low

  
severity/medium
Security severity: medium

  
status/abandoned
Someone started, then walked away - up for grabs

  
status/blocked
Blocked by another issue or an external dependency

  
status/needs-decision
Waiting on a maintainer decision; workable once decided

  
status/needs-info
Waiting on reporter / more information before work can start

  
status/needs-verification
Done except verification in a live interactive session

  
testing
Test suite / CI infrastructure work

  
upstream
Related to an upstream repository, already reported there

No labels
breaking
bug
documentation
enhancement
epic
good first issue
help wanted
refactoring
resolution/duplicate
resolution/invalid
resolution/wontfix
security
severity/critical
severity/high
severity/low
severity/medium
status/abandoned
status/blocked
status/needs-decision
status/needs-info
status/needs-verification
testing
upstream
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
sixfold-space/madtea!489
No description provided.