| 1 | # Privileged Workflows |
| 2 | |
| 3 | - Privileged jobs must not run untrusted repository code with secrets or write |
| 4 | credentials. |
| 5 | - Validate cross-run data for expected source, identity, type, shape, and |
| 6 | bounded size before using it in commands, outputs, APIs, or comments. |
| 7 | - Require the intended approval boundary before fork-originated work reaches |
| 8 | privileged execution. |
| 9 | - Preserve publication and other irreversible operations until completion; |
| 10 | cancel only replaceable checks and previews. |
| 11 | - Make checkout revision and credential persistence explicit. Account for |
| 12 | every write permission and credential. |
| 13 | |
| 14 | Search current workflows by event, job purpose, action, and permission to find |
| 15 | the nearest precedent for fork approval gates, publication, non-cancelable |
| 16 | concurrency, and validation of cross-run artifacts before privileged use. |
| 17 | |
| 18 | Consult current GitHub documentation for event, token, secret, permission, |
| 19 | checkout, artifact, reusable-workflow, and environment semantics. Start with |
| 20 | the workflow events, workflow syntax, and secure-use references. |