From 85107b9a5a05c06211c0eba634f49a2f9c3fcf78 Mon Sep 17 00:00:00 2001 From: Igor Beylin <31744795+cryptoxdog@users.noreply.github.com> Date: Wed, 15 Jul 2026 23:23:06 -0400 Subject: [PATCH 1/2] ci: adopt canonical l9-ci-core pipeline Add thin reusable-workflow caller (exact-SHA pin, secrets: inherit, main). preflight-run: 320c271ebaed --- .github/workflows/ci.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 .github/workflows/ci.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..44740ee --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,15 @@ +name: CI + +on: + pull_request: + branches: + - main + push: + branches: + - main + workflow_dispatch: + +jobs: + ci: + uses: Quantum-L9/l9-ci-core/.github/workflows/pr-pipeline.yml@102c9a5960c53c607216d320339e0457046948cb + secrets: inherit From eaca7f2f5eb7df1eedfc35696c847d36b676fa13 Mon Sep 17 00:00:00 2001 From: Igor Beylin Date: Mon, 20 Jul 2026 00:08:34 -0400 Subject: [PATCH 2/2] ci: scope inherited secrets to SDK_TOKEN only secrets: inherit exposed every org/repo secret to the reusable pr-pipeline.yml workflow, which only declares SDK_TOKEN as an input. SonarCloud flagged this as a Security Hotspot (C rating, rule githubactions:S7635) and failed the PR quality gate. Passing SDK_TOKEN explicitly preserves current behavior (SDK_TOKEN is an org-level secret available to this repo) while dropping the unnecessary blanket secret exposure. Co-authored-by: Cursor --- .github/workflows/ci.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 44740ee..797cb07 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -12,4 +12,5 @@ on: jobs: ci: uses: Quantum-L9/l9-ci-core/.github/workflows/pr-pipeline.yml@102c9a5960c53c607216d320339e0457046948cb - secrets: inherit + secrets: + SDK_TOKEN: ${{ secrets.SDK_TOKEN }}