Restrict sdk-py integration secrets to trusted refs

2026-08-17 21:25:46 +02:00 · 2026-07-09 03:19:53 +00:00
1 changed files with 8 additions and 2 deletions
@@ -165,10 +165,16 @@ jobs:

  sdk-py-integration-test:
    needs: changes
-    if: needs.changes.outputs.sdk_py == 'true'
+    # This suite builds and runs PR-controlled integration files with
+    # LANGSMITH_API_KEY available to the container. Keep it off pull_request
+    # runs so repository secrets are only exposed on trusted refs.
+    if: github.event_name != 'pull_request' && needs.changes.outputs.sdk_py == 'true'
    name: "sdk-py integration test"
    uses: ./.github/workflows/_sdk_integration_test.yml
-    secrets: inherit
+    secrets:
+      LANGSMITH_API_KEY: ${{ secrets.LANGSMITH_API_KEY }}
+      DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
+      DOCKERHUB_RO_TOKEN: ${{ secrets.DOCKERHUB_RO_TOKEN }}

  ci_success:
    name: "CI Success"