fix: complete open-source delivery and isolate community CI

tests/test_publication_security.py

@@ -34,3 +34,22 @@ def test_actions_downloads_do_not_depend_on_personal_server():
             r"https://github\.com/actions/(checkout|setup-python)@[0-9a-f]{40}",
             action,
         )
+
+
+def test_community_checks_are_isolated_from_private_runners():
+    import yaml
+
+    private = yaml.safe_load(Path(".github/workflows/verify.yml").read_text())
+    public = yaml.safe_load(Path(".github/workflows/community.yml").read_text())
+    assert (
+        "github.server_url != 'https://github.com'" in private["jobs"]["verify"]["if"]
+    )
+    job = public["jobs"]["verify"]
+    assert job["if"] == "github.server_url == 'https://github.com'"
+    assert job["runs-on"] == "ubuntu-latest"
+    assert public["permissions"] == {"contents": "read"}
+    workflow = Path(".github/workflows/community.yml").read_text()
+    assert "secrets." not in workflow
+    assert "production-deploy" not in workflow
+    assert "pull_request_target" not in workflow
+    assert "persist-credentials: false" in workflow