Skip to content

chore: ready the repository for public visibility - #448

Merged
harlan-zw merged 2 commits into
mainfrom
chore/public-repo-audit
Oct 6, 2026
Merged

harlan-zw merged 2 commits into
mainfrom
chore/public-repo-audit

Conversation

@harlan-zw

Copy link
Copy Markdown
Collaborator

🔗 Linked issue

None.

❓ Type of change

  • 📖 Documentation
  • 🐞 Bug fix
  • 👌 Enhancement
  • ✨ New feature
  • 🧹 Chore
  • ⚠️ Breaking change

📚 Description

This repository is about to go public. Two workflow paths would then let a stranger run code on the workstation or ship it to production:

  • Test runs every job on the self-hosted workstation pool for any pull_request. A fork's pull request would run its own code on that host.
  • Deploy to Cloudflare deploys any successful Test run whose head_branch is main. A fork's branch named main matches. The deploy then checks out the fork's commit and builds it with production secrets.

Test now runs each job only for a push or for a pull request from a branch in this repository. A fork's run skips every job, and a run of skipped jobs still concludes success. So Deploy to Cloudflare now also requires a push event from this repository.

CI and deploy after this change: a fork pull request skips Test's workstation jobs, and only a push from this repository reaches the deploy

Ten comments cited GOOGLE_RECOVERY.md, which is gitignored, or a note under ~/scratch. Nobody who clones the repository can read either. Each comment now states its own reason. The AGENTS.md trap about those comments becomes a rule against such citations.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

Fork pull requests must never reach the workstation runners, and a fork branch named main must never deploy. Comments that cited a gitignored file or a local path now carry their own reason.
@harlan-zw harlan-zw added the harlan-agent-review Pull request triage requires an adversarial Review. Adding this label manually always forces one. label Oct 6, 2026
@harlan-github-agent harlan-github-agent Bot added harlan-agent-review-required Pull request triage requires an adversarial Review for this head commit. harlan-agent-running An Agent holds a Task on this issue or pull request right now. and removed harlan-agent-review Pull request triage requires an adversarial Review. Adding this label manually always forces one. labels Oct 6, 2026
@harlan-github-agent

harlan-github-agent Bot commented Oct 6, 2026 •

Copy link
Copy Markdown
Contributor

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-10-06 02:45 UTC.

GitHub merged this pull request.

  • Logged (15/100): The PR's only visual proof of the fork-skip and deploy-gate behavior is inaccessible to this review; the claim is instead confirmed by reading the workflow expressions. View code
    • Ask an agent to verify and fix this finding
  • Logged (20/100): A security-relevant comment attributes the fork safety of the self-hosted reusable workflow to repository privacy, a fact this PR itself makes false. View code
    • Ask an agent to verify and fix this finding

d602ec48-0899-4364-a8e3-d8904c9cbf4b

Selected findings run after merge and open separate pull requests.

The copy contract test rejects any root Markdown line that names a home path.
@harlan-github-agent harlan-github-agent Bot removed the harlan-agent-running An Agent holds a Task on this issue or pull request right now. label Oct 6, 2026
@harlan-zw harlan-zw added the harlan-agent-review Pull request triage requires an adversarial Review. Adding this label manually always forces one. label Oct 6, 2026
@harlan-github-agent harlan-github-agent Bot added harlan-agent-running An Agent holds a Task on this issue or pull request right now. harlan-agent-review-required Pull request triage requires an adversarial Review for this head commit. and removed harlan-agent-review Pull request triage requires an adversarial Review. Adding this label manually always forces one. harlan-agent-review-required Pull request triage requires an adversarial Review for this head commit. harlan-agent-running An Agent holds a Task on this issue or pull request right now. labels Oct 6, 2026
@harlan-github-agent harlan-github-agent Bot added harlan-agent-review-required Pull request triage requires an adversarial Review for this head commit. harlan-agent-running An Agent holds a Task on this issue or pull request right now. harlan-agent-ready The automated Review passed every gate on this head commit. and removed harlan-agent-running An Agent holds a Task on this issue or pull request right now. harlan-agent-review-required Pull request triage requires an adversarial Review for this head commit. labels Oct 6, 2026

@harlan-github-agent harlan-github-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Harlan Agent Kit posted this automated review. AI open source policy.

Automated Review: READY.

Read the Review results

@harlan-zw
harlan-zw merged commit 6ecedf9 into main Oct 6, 2026
7 checks passed
@harlan-github-agent harlan-github-agent Bot removed the harlan-agent-ready The automated Review passed every gate on this head commit. label Oct 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant