Protect the trusted-self-hosted-validation environment before enabling PR #154

[FlorianPfaff]

Purpose

PR #154 introduces the only permitted workflow for executing an explicitly reviewed pull-request revision on workstation2. The workflow is manual, same-repository-only, exact-SHA-bound, read-only, and checks authorization on a GitHub-hosted runner before self-hosted checkout.

The hard-coded GitHub environment must be protected before the workflow is used or PR #154 is made ready for merge.

Required repository settings

Create an environment named exactly:

trusted-self-hosted-validation

Configure all of the following:

• require at least one independent reviewer;
• attach no environment secrets;
• attach no repository, deployment, cloud, package-registry, or write credentials;
• restrict deployment branches/tags so the workflow definition must come from main;
• disallow self-approval by the pull-request author where the repository settings support it;
• preserve the workflow's read-only contents and pull-requests permissions; and
• require the approver to compare the displayed PR number and complete 40-character head SHA with the reviewed source.

Runner-host boundary

Environment approval is authorization, not sandboxing. Before first use:

• run the Actions runner under a dedicated non-administrator account;
• remove SSH, cloud, registry, package-publishing, and personal credentials from that account;
• expose only explicitly approved datasets and prefer read-only mounts;
• keep unopened target cohorts outside the ordinary runner namespace unless a separately sealed protocol authorizes access;
• restrict unrelated homes, repositories, caches, services, and network destinations; and
• define incident handling and runner rebuild/rotation after a suspected boundary violation.

Acceptance check

After PR #154 is green and the environment is protected:

1. dispatch Trusted exact-head validation from main for PR Harden self-hosted validation and add security scanning #154 and its exact current head SHA;
2. verify the hosted authorization job succeeds;
3. verify the self-hosted job pauses for environment approval before checkout;
4. approve independently and verify the retained evidence names the same PR, exact head and base SHA, runner, Python environment, distribution digests, and selected validation lanes;
5. repeat with an intentionally stale SHA and verify failure occurs in the hosted authorization job before any self-hosted checkout; and
6. verify an attempted dispatch from a non-main ref fails before self-hosted execution.

Claim boundary

This setting protects privileged implementation validation. It does not authorize held-out target access, establish accuracy or calibration, approve deployment, or constitute scientific evidence.