#3735 SPAM Pull request opened by ryanduguid Summary Keeps fork and secretless workflow runs from contacting external services while preserving all core test, typing and coverage-report gates. • runs the GitLab external-test setup and Nox session only when the workflow belongs to

meltano/sdk

and all three sample GitLab secrets are non-empty; • records an explicit job-summary reason when external tests are skipped; • keeps the coverage combine/report/XML steps unconditional; • uploads to Codecov only for

meltano/sdk

with a non-empty token, retains

fail_ci_if_error: true

when upload is enabled, and records an explicit skip summary otherwise; • adds static workflow regressions for both trust boundaries. The core test and typing matrices are unchanged and unconditional. Verification at

0563e2dfc9b8c68766f856f5b0984c56761388fb

•

pytest tests/test_workflow_safety.py -q

— 2 passed; • Ruff check and format checks passed for the static regression; • repository

actionlint

pre-commit hook passed for `.github/workflows/test.yml`; •

git diff --check

passed. No external service was contacted during validation. Summary by Sourcery Restrict external-service tests to trusted workflows while preserving unconditional core validation and coverage reporting. Bug Fixes: • Prevent external GitLab tests from running in fork workflows and fail clearly when required sample secrets are unavailable. Enhancements: • Keep core testing, typing, coverage generation, and Codecov upload behavior unconditional, including tokenless fork uploads. • Add workflow safety regression tests covering fork isolation, secret requirements, Codecov behavior, and unconditional coverage reporting. CI: • Harden the test workflow so external-service access is restricted to trusted contexts while preserving existing quality gates. Tests: • Add static tests that enforce the workflow’s external-service and coverage safety boundaries. meltano/sdk