docs(#6063): add pull_request_target secrets security section to ci-workflows.md

[fullsend-ai-coder]

Summary

Add a "Secrets in pull_request_target jobs" section to docs/contributing/ci-workflows.md documenting the pwn-request attack chain pattern and review guidance for PRs that add secrets to jobs executing untrusted code. Update the AGENTS.md topic index so agents consult this guide when reviewing secret additions.

Changes

• docs/contributing/ci-workflows.md — New section covering:
  • The 5-component attack chain (event type → checkout → code execution → env access → credential type)
  • Credential blast-radius table (short-lived scoped vs long-lived broad)
  • Gate job (check-e2e-authorization) mitigation and its limitations
  • Review checklist for PRs adding secrets to e2e/behaviour jobs
  • ADR-0009 distinction (safe shim vs dangerous e2e/behaviour jobs)
• AGENTS.md — Updated "When to read" column for CI Workflows to mention secrets in pull_request_target jobs

Testing

• lychee link check passes on changed files (19 total, 0 errors)
• No tests needed — documentation-only change
• gitlint passes on commit message

---

Closes #6063

Post-script verification

• Branch is not main/master (agent/6063-pt-secrets-security-docs)
• Secret scan passed (gitleaks — 483ad9bd31407310940d21003a6cfe1b6b52b5c8..HEAD)
• PR body secret scan passed (gitleaks — no-git)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:04 PM UTC · Completed 8:21 PM UTC

Commit: 13a8129 · View workflow run →

[github-actions]

Site preview

Preview: https://01c0a974-site.fullsend-ai.workers.dev

Commit: 13a812979b89e70daab22c186c3cc0cebf70c017

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] AGENTS.md — This PR modifies AGENTS.md, which is a protected governance file requiring human approval. The change is authorized by issue Document pull_request_target + secrets security review checklist in ci-workflows.md #6063, which explicitly requests updating the AGENTS.md table entry to reference the new secrets-in-pull_request_target guidance. The change itself is a single-line update to the "When to read" column — adding ", or adding secrets to pull_request_target jobs" — and is consistent with the new documentation section added to ci-workflows.md. Human approval is required for all protected-path changes regardless of authorization context.

---

Labels: PR adds CI security guidance documentation and updates the AGENTS.md topic index

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 12:00 PM UTC · Completed 12:13 PM UTC

Commit: 13a8129 · View workflow run →

[fullsend-ai-retro]

Retro: PR #6070 — docs(#6063): add pull_request_target secrets security section

Verdict: Clean workflow, no new proposals.

This PR was part of a retro-originated feedback loop: issue #6063 was filed by the retro agent after PR #6028, where the review agent missed a pwn-request vulnerability that a human reviewer caught. The fix was to document the security pattern so both agents and humans can catch it in future reviews.

Timeline

Time (UTC)	Event
08-10 19:51	Issue #6063 filed by retro agent
08-10 19:51	Triage dispatched (run 31426158665)
08-10 19:55	Triage completed (4 min, $0.45) — labeled ready-to-code
08-10 19:56	Code agent dispatched (run 31426532565)
08-10 20:03	PR #6070 opened (single commit, 50 additions / 1 deletion, 2 files)
08-10 20:03	Review dispatched (run 31427130118); duplicate dispatch (run 31427134768) cancelled within 5s by concurrency group
08-10 20:21	Review completed (15 min) — 1 medium finding (protected-path on AGENTS.md), action: comment
08-11 11:54	Human reviewer @ifireball approved
08-11 11:58	PR merged

What went well

• Retro feedback loop working as designed. The retro agent identified a review gap on PR ci(#6026): route actor PAT secrets into behaviour job #6028, filed a well-scoped issue, and the automated pipeline (triage → code → review) delivered a clean fix that was merged without modifications. Total agent wall-clock time: ~26 minutes.
• Code agent research depth. The code agent read ADR-0009, e2e.yml, and the check-e2e-authorization action before writing — verifying technical details rather than parroting the issue description. This produced accurate security documentation.
• Review agent technical verification. The correctness sub-agent (claude-opus-4-6, 2m 4s) performed thorough fact-checking: read the full e2e.yml workflow (260+ lines), ADR-0009, and both the authorization action and script to verify every claim in the documentation. It found one genuine imprecision (id-token: write vs. "without write permissions") and correctly rated it info-level since it doesn't affect the security reasoning.
• Challenger sub-agent value. The challenger correctly removed two findings that would have been false positives: (1) a style-conventions finding about table entry phrasing that was actually consistent with existing patterns, and (2) a docs-currency finding suggesting ADR-0009 be updated, which would violate the ADR immutability policy.
• Zero rework. Single commit, no fix cycles, merged as-is.

Existing issues with new evidence

• fullsend-ai/agents#427 (Track autonomy evidence: review agent competently handles docs-only PRs) — This PR provides strong positive evidence. The review agent's correctness sub-agent verified security documentation claims against actual workflow files and produced accurate findings. The human reviewer approved without comments.
• fullsend-ai/fullsend#2199 (Review agent should fact-check technical claims in documentation PRs) — Positive evidence that the review agent already does this well for security documentation, reading source implementation files to verify claims.
• fullsend-ai/fullsend#1557 (Review-fix race condition causes duplicate review cycles) — The duplicate review dispatch (opened+labeled events within 1 second) was handled correctly by the concurrency group, with the duplicate cancelled in ~5 seconds. Minimal waste.
• fullsend-ai/agents#373 (Skip irrelevant review dimensions for docs-only PRs) — Nuanced evidence: the style-conventions and docs-currency sub-agents both produced findings that were correctly filtered by the challenger, suggesting these dimensions add marginal value for docs PRs but the challenger provides adequate protection against false positives.