joel.poyet 2387d27f2c Record the self-hosted-runner trade-off as an accepted risk ...

unit-tests.yml moving to [self-hosted, macOS] on a pull_request trigger lets
any PR run arbitrary code on novaloop-mac-studio-001 — the same persistent
machine, keychain and signing identities the release pipeline uses. The risk
was accepted on the strength of the repo being INTERNAL, but that reasoning
lived nowhere: nothing in the repo said why it was tolerable, and nothing in
CI would ever say it existed.

Worth recording because the trade-off is invisible to the required checks.
zizmor reports self-hosted-runner only at --persona=auditor; the default
persona CI runs suppresses it, so a green build is not evidence of absence.
Verified both halves against the fix-fork-ci workflow: auditor reports it at
medium severity, the default reports "No findings to report … (3 suppressed)".

Records the exits too, so a future reader inheriting this need not rederive
them: restrict the trigger to non-fork branches, or return to GitHub-hosted
macos-26 with a raised timeout-minutes.

2026-10-19 09:17:26 +02:00

..

plans

Resync the release plan's embedded workflow and skill with the shipped files

2026-10-19 09:17:26 +02:00

specs

Record the self-hosted-runner trade-off as an accepted risk

2026-10-19 09:17:26 +02:00