# GitHub Actions security

Apply this guidance whenever editing `.github/**`.

- `issue_comment` and `pull_request_target` jobs execute the workflow from the
  trusted default/base branch. Syncing a PR does not change an existing
  comment-triggered run.
- Never check out or execute an untrusted PR head in a secret-bearing or
  comment-triggered job before a privileged agent or action. Keep the default
  branch checkout, use `persist-credentials: false`, and treat PR metadata,
  diffs, and files as untrusted data.
- Constrain capabilities in the tool policy, not prompt text alone. For PR-file
  reads, prefer a small GET-only helper bound to the event PR/head; validate
  normalized repository-relative paths, regular-file type, response path,
  size, encoding, and content. Do not grant generic `gh api`, arbitrary
  interpreters, or broad Bash merely to read PR files.
- PR label/metadata cleanup jobs that operate on pull requests must declare
  `pull-requests: write`, not `issues: write`; mirror the permission shape used
  by `preview-env.yml`.
- Release workflow changes must trace prepare/summary outputs and conditions
  through every build and publication job: skip decisions must propagate
  without accidental publishing, while backfill must reuse and validate the
  existing tag and still run its required build/publication path. Verify each
  actual publication job and artifact, not only the aggregate workflow result.
- For workflow security changes, run the relevant raw workflow-contract tests,
  `python3 .github/scripts/lint-action-pinning_test.py`, `zizmor .github/workflows`,
  and `git diff --check`.