Prepare public repository privacy and trusted runner gates

2026-10-11 01:13:55 +08:00
parent 9c9697dc6e
commit c9c950de1b
6 changed files with 73 additions and 17 deletions
@@ -0,0 +1,23 @@
+from pathlib import Path
+
+
+def test_external_forks_do_not_execute_on_nas_runner():
+    workflow = Path(".github/workflows/verify.yml").read_text()
+    assert (
+        "github.event.pull_request.head.repo.full_name == github.repository" in workflow
+    )
+    assert "needs: verify" in workflow
+
+
+def test_private_production_configuration_uses_secrets():
+    workflow = Path(".github/workflows/verify.yml").read_text()
+    for key in (
+        "PROD_DATA_DIR",
+        "PROD_CONFIG_DIR",
+        "PROD_PHOTOS_DIR",
+        "PROD_WEB_BIND",
+        "SYNOLOGY_PHOTOS_URL",
+        "SYNOLOGY_PHOTOS_CERT_SHA256",
+    ):
+        assert "${{ secrets." + key + " }}" in workflow
+        assert "${{ vars." + key + " }}" not in workflow