Install the trusted base append gate workflow on the default branch#95
Merged
Conversation
GitHub sources pull_request_target workflow definitions from the default branch, so the thesis-facts append gate's trusted-base job only becomes an unspoofable trust root once this file exists on main. All triggers filter on codex/thesis-ledger-facts, so the workflow is inert for main's own PRs and pushes. A repository ruleset requiring this workflow by path and ref accompanies this install; a display-name-only required status check would be spoofable by candidate-controlled workflow YAML. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Installs the pull_request_target trusted-base job (sourced by GitHub from the default branch) so it can serve as the unspoofable trust root for PRs into codex/thesis-ledger-facts. Inert for main itself — every trigger filters on the thesis-facts branch. Companion ruleset (require workflow by path+ref) follows via API after merge. Part of the producer-signing hardening (ledger#94).
🤖 Generated with Claude Code