DeepSeek/deepseek-harness
1
0
Fork 0
mirror of https://github.com/deepseek-ai/deepseek-harness synced 2026-08-15 21:04:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(rfc): record real-API e2e CI decision + security model

Browse Source 
Adds docs/rfc/implemented/2026-06-19-real-api-e2e-ci.md covering the rationale
for running the real-API e2e suite in a separate secret-consuming workflow, the
fork/Dependabot/secret threat model, the residual exposure of the pull_request
trigger, and what changes when the repo goes public. Indexes it in the RFC
README.

Also adds a SECURITY comment on the pull_request trigger forbidding a switch to
pull_request_target (an untrusted-code-with-secrets leak vector, especially once
public), pointing at the RFC.
This commit is contained in:
Tianyi Cui
2026-06-19 18:42:27 +08:00
parent c4d0e07488
commit 27721f9f45
3 changed files with 104 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.github/workflows/e2e.yml vendored
View File

@@ -17,6 +17,14 @@ name: E2E (real DeepSeek API)
# job skipped by a job-level `if:` reports as a SUCCESSFUL check, so this
# workflow is safe to use as a required status check if desired.
#
# SECURITY — NEVER change this trigger to `pull_request_target`. `pull_request`
# checks out and runs the PR's HEAD code WITHOUT secrets for forks, which is what
# keeps an untrusted fork from exfiltrating the key. `pull_request_target` runs
# in the BASE repo's context WITH secrets while still able to check out untrusted
# fork code — a textbook key-leak vector, especially once this repo is public.
# The fork/secret model and its public-repo implications are recorded in
# docs/rfc/implemented/2026-06-19-real-api-e2e-ci.md.
#
# Note: scheduled triggers are auto-disabled after 60 days of repo inactivity;
# push/pull_request/workflow_dispatch act as backstops.
on: