Overview
Gate adapter changes on contract integrity and sanitized behavior while keeping external tenant access isolated, read-only, and manually authorized.
Prerequisites
- Deterministic local tests and sanitized fixtures from
mindtickle-local-dev-loop - Protected branches, pinned CI permissions, a secret scanner, and artifact retention policy
- A separately owned non-production tenant principal if a live smoke lane is justified
Tool Discipline
Use Read, Glob, and Grep to inspect workflows and dependency locks, WebFetch for current CI and tenant contracts, and Write or Edit for workflow files, tests, and redacted evidence.
Current Contract
The always-on lane must not depend on a live Mindtickle tenant. A live lane is optional and must use the customer's documented read-only operation, protected environment approval, bounded execution, and redacted logs.
Authentication
Grant workflow tokens minimal repository permissions. Store any tenant credential in the CI secret provider, restrict it to the protected environment, prevent fork access, and never expose it to pull-request code.
Instructions
- Inventory CI triggers, permissions, third-party actions, caches, artifacts, and secret exposure paths.
- Build an always-on lane for metadata validation, secret scanning, static checks, unit tests, contract fixtures, and generated-content drift.
- Pin actions and dependencies according to repository policy and reject unreviewed network downloads.
- Assert fixture sanitization, contract digest, tenant isolation, retry bounds, mutation denial, and stable output.
- If justified, add a separate manual or protected-main smoke lane using one documented read-only operation and a strict timeout.
- Ensure fork pull requests never receive tenant secrets and smoke logs record only status and safe identifiers.
- Test success, missing secret, revoked access, contract mismatch, timeout, and artifact-redaction paths.
- Record gate names, expected counts, owners, rollback, and credential rotation procedure.
Approval Boundaries
Do not expose secrets to forks, run live writes, weaken branch protection, or make a tenant-dependent lane mandatory without repository and tenant-owner approval.
Output
Return the CI threat model, gate graph, permissions, fixture and contract assertions, optional smoke boundary, failure tests, artifact policy, and verification receipt.
Error Handling
| Condition | Response |
|---|---|
| Fork workflow requests a secret | Deny the secret and run only the fixture lane. |
| Contract digest changes | Fail closed and require the migration workflow. |
| Smoke response is ambiguous | Stop without retrying and reconcile through approved evidence. |
Example
fixture-lane=required; live-smoke=protected-read-only; fork-secrets=none; contract-digest=matched; gates=all-pass
Resources
Next Steps
Require the CI gate on protected branches and rehearse credential revocation without changing fixture coverage.