Continuous Integration Contract

The workflows under .github/workflows/ are active at the repository root. They never check out another source repository: ssh-wrapper==0.1.0 is resolved only from the hash-locked published dependency graph.

CI grants read-only contents permission by default, pins every external action to a full commit SHA, and persists no checkout credentials. The quality job runs make ci with Python 3.14; that aggregate also executes the complete suite in the disposable Python 3.13 compatibility image. Pull requests receive dependency review. The same reviewed configuration drives that GitHub check and the blocking local five-environment license gate inside make ci; the local gate resolves every package version only from the generated locks and rejects an exception whose package is no longer present. CodeQL receives security-events: write only in its own job. The automatic live job runs with Python 3.14 only after quality succeeds, uses a newly generated identity, and also exercises the isolated production launcher. Separate Ubuntu 26.04 jobs build and smoke standalone Linux executables natively on amd64 and arm64. Hardware-token tests remain operator controlled.

The documentation workflow renders and audits the complete site on relevant pull requests and main pushes. Pull requests receive no Pages credentials or artifact deployment. Only the direct-main deploy job receives pages: write and id-token: write, and it publishes the exact site produced by the audited build job.

Dependency submission and release run only on trusted direct pushes to main. Their write permissions are scoped to the single job that submits the validated dependency graph or publishes the exact release. The release caller preserves the exact executables produced by those CI jobs; the publication job downloads rather than rebuilds them.

A separate pull_request_target metadata workflow runs only when a pull request changes CHANGELOG.md. It checks out trusted main code, reads the exact head changelog through the GitHub API as bounded inert data, and updates only one marker-delimited section of the pull-request body. Manual text outside that section is preserved. The workflow re-reads the body immediately before writing and refuses to overwrite a concurrent edit; it never checks out or executes pull-request code and is the only workflow granted pull-requests: write.