# CI Security Policy

Status: VERIFIED BY LOCAL SELF-TEST

## Rule

Generated repos must run publication gates with read-only GitHub token scope and
without PR-exposed secrets.

The CI security gate blocks:

- `pull_request_target`;
- `permissions: write-all`;
- any explicit `*: write` permission;
- inline write permissions such as `permissions: { contents: write }`;
- `${{ secrets.* }}` usage in gate workflows;
- checkout credential persistence;
- missing or excessive workflow timeout.

## Required Shape

- `permissions: contents: read`;
- `actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5`;
- `persist-credentials: false`;
- `timeout-minutes <= 15`;
- `Test-H8CiSecurityPolicy.ps1` included in the gate workflow.

## Command

```powershell
powershell -NoProfile -ExecutionPolicy Bypass -File .\tools\Test-H8CiSecurityPolicy.ps1 `
  -Root C:\hades\Hecton8_PublicSDK_Export `
  -Target public-sdk
```