Test the branch that holds the authority

Give split-trust workflows a positive-path fixture

Use when. An untrusted GitHub Actions job hands minimal data to a later workflow_run job with write permissions—for example, to label, comment on, close, publish, or deploy. The ordinary “nothing flagged” path is insufficient evidence.

Action. Keep the boundary narrow: let the read-only stage emit only a digits-only PR number; in the privileged stage, re-fetch state, author association, labels, and changed files, and never check out or execute pull-request code. Verify every queried field against the actual CLI schema. In this incident, replace the nonexistent gh pr view --json authorAssociation field with the REST endpoint:

assoc="$(gh api "repos/$GH_REPO/pulls/$PR_NUMBER" \
  --jq '.author_association')"

Add a disposable-repository or dry-run fixture that uploads the same artifact as a flagged external pull request and reaches the guarded comment/label/close seam. Test malformed input, trusted authors, mixed file changes, and already-processed records as separate no-op cases.

Acceptance check. The flagged fixture reaches the side-effect seam with the expected re-derived values; malformed artifacts fail closed; trusted and nonmatching fixtures exit without writes. A run that only reports success because no artifact existed fails acceptance.

Caveat. The endpoint and field names are GitHub-specific, and one repository incident does not prove every split workflow is broken. Because workflow_run may access secrets and write tokens, run the positive-path check in a disposable repository or stop before destructive effects.