Guard write workflows from fork pull requests

[jeffhuber]

Closes #664.

Summary

• skip write-capable pull_request_target gate and clear-stale jobs for fork PRs
• preserve manual dispatches and gate workflow_run handling
• keep canonical templates, packaged mirrors, and the packaged fallback aligned
• document the fork posture and test generated workflows

Builder

Muse (muse-spark-1.3-contributor) implemented this bounded issue. Its first invocation required one pre-model workspace-argument correction. The completed run reported 15 Board test failures because its sandbox could not bind loopback sockets; the same full suite passes on the host.

Verification

• 868 unit tests passed on the host
• 5 focused fork-guard tests passed
• Ruff passed
• privacy scan passed
• compileall passed
• actionlint passed for all 13 generated workflows
• git diff --check passed

Privacy

No source, diffs, transcripts, raw provider output, local paths, auth output, or secrets are uploaded. Builder and reviewer reporting remains metadata-only.

CODE_MOWER_BUILDER:muse

[jeffhuber]

Codex audit (merge-authority lane)

Head SHA: 3947cf650722f3ad9dc125e3d84d35abc5c5c8f2
Findings: P0=0, P1=1, P2=0, P3=0 (blocker policy: any P0/P1/P2 → BLOCKED)

Codex Audit: BLOCKED

Summary:

The checked-in deployed workflows remain vulnerable because only the generated templates received the fork-PR guard.

Findings:

• [P1] Guard the checked-in workflows too -- /private/var/folders/f2/g9zqfdjx7z3ckcsx_f46htwm0000gn/T/codex-audit-z_cluksq/wt/templates/workflows/code-mower-gate.yml.j2:43
  Finding ID: codex:0369ee4b72460290810c
  The new guard only reaches workflows generated after this change; the repository's active .github/workflows/code-mower-gate.yml, codex-clear-stale.yml, and claude-clear-stale.yml remain unguarded and will still execute their write-capable pull_request_target jobs for fork PRs. Regenerate or update those checked-in workflows alongside this template change so the repository itself receives the security fix.

[jeffhuber]

Claude audit (merge-authority lane)

Head SHA: 3947cf650722f3ad9dc125e3d84d35abc5c5c8f2
Findings: P0=0, P1=0, P2=0, P3=0 (blocker policy: any P0/P1/P2 -> BLOCKED)

Claude Audit: PASS

Summary:

Test call to isolate schema error.

Findings: none.

[jeffhuber]

Codex finding codex:0369ee4b72460290810c is accepted and fixed in 9d41849.

The same-repository guard is now present in Code Mower's three active checked-in workflows as well as the canonical templates, packaged mirrors, and fallback. A regression test verifies all active workflows carry the guard.

Independent verification on the new head:

• 869 unit tests passed
• 6 focused fork-guard tests passed
• Ruff passed
• generated-workflow actionlint passed for all 13 workflows
• git diff --check passed

The direct whole-repository actionlint command still reports the two pre-existing SC2016 informational findings in the gate's intentional GraphQL literals; the project's generated-workflow actionlint harness passes. A fresh final-head Codex and Claude review is required before merge.

[gitar-bot]

Code Review ✅ Approved

Guards write-capable workflows from fork pull requests by skipping pull_request_target and clear-stale jobs while preserving manual dispatches and workflow_run handling. Canonical templates, packaged mirrors, and fallbacks remain aligned, with fork posture documented and generated workflows tested. No issues found.

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Showing less information.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[jeffhuber]

Codex audit (merge-authority lane)

Head SHA: 9d4184976e4cbdbc54da4905c99eb6a04815f9f1
Findings: P0=0, P1=0, P2=0, P3=0 (blocker policy: any P0/P1/P2 → BLOCKED)

Codex Audit: PASS

Summary:

The review found no blocking issues; the added guards and related templates, workflows, documentation, and tests are aligned.

Findings: none.

[jeffhuber]

Claude audit (merge-authority lane)

Head SHA: 9d4184976e4cbdbc54da4905c99eb6a04815f9f1
Findings: P0=0, P1=0, P2=0, P3=0 (blocker policy: any P0/P1/P2 -> BLOCKED)

Claude Audit: PASS

Summary:

PR adds a job-level if: github.event_name != 'pull_request_target' || github.event.pull_request.head.repo.full_name == github.repository guard to the clear-stale and gate workflows (both live and template/mirror copies), correctly blocking fork-originated pull_request_target events (which run with write permissions/secrets) while preserving workflow_dispatch and workflow_run triggers. The guard expression is a standard, fail-closed fork check, template/mirror files stay in sync, docs are updated to match, and new tests cover both the checked-in workflows and generated output. No correctness, security, or contract issues found.

Findings: none.