LUC4N3X Thalarch CI
CI failure path
- Identify the exact failing job/step.
- Read the relevant log around the first actionable failure.
- Map it to repository workflow/config/source.
- Compare with the last known working configuration when possible.
- Form and test one hypothesis.
- Fix the smallest source/config surface.
- Validate workflow syntax/config and targeted build locally where possible.
Workflow security
For workflow changes inspect:
- untrusted event/input interpolation;
pull_request_target/ privileged trigger semantics;- token permissions;
- secret exposure;
- mutable third-party actions;
- self-hosted runner exposure;
- artifact/download trust boundaries;
- shell injection through expressions/env.
Side effects
Build/test is not permission to:
- publish;
- deploy;
- sign production artifacts;
- create a release;
- push/merge.
Those need explicit authorization.