Distillation

Date: September 10, 2026

• 🔴 (12:36) User stated the CI poller always adds ci-ready; the publish workflow therefore avoids racing its own ci-ready handoff with waiting-for-ci on the same event.
• 🔴 (12:36) User’s security rule for .github/workflows/ci-poller-dispatch.yml: repository secrets must never be used by this workflow; the protected production environment ensures an arbitrary workflow_dispatch ref cannot add environment secrets.
• 🔴 (12:36) .github/workflows/ci-poller-dispatch.yml is a 16-line workflow named Run CI Status Poller, triggered by workflow_dispatch, with top-level permissions: {}. Its sole job dispatch uses environment: production, runs on ubuntu-latest, and has one no-op step: run: ":".
• 🔴 (12:36) .github/workflows/cocoapods-keepalive.yml is a 27-line workflow named CocoaPods Token Keep-Alive; it runs daily at midnight UTC via cron "0 0 * * *" because CocoaPods sessions expire after 3 days of inactivity (VALIDITY_LENGTH).
• 🔴 (12:36) The CocoaPods keep-alive job keepalive is named Refresh CocoaPods Session, runs on macos-15 in the production environment, has contents: read permission, and exposes COCOAPODS_TRUNK_TOKEN from ${{ secrets.COCOAPODS_TRUNK_TOKEN }}.
• 🔴 (12:36) The CocoaPods keep-alive sequence is: 1. gem install cocoapods, 2. pod --version, 3. pod trunk me > /dev/null 2>&1 to refresh the session.
• 🔴 (12:37) .github/workflows/test.yml is a 34-line workflow named Test, triggered by pushes to main and by pull_request, with contents: read permission and Bash as the default run shell.
• 🔴 (12:37) .github/workflows/test.yml defines job unit-test, displayed as unit tests, on ubuntu-latest; it pins actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803, actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38, and Node.js 24.
• 🔴 (12:37) The test workflow pins actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830, caches node_modules, and uses key ${{ runner.os }}-node_modules-${{ hashFiles('package.json', 'yarn.lock') }}.
• 🔴 (12:37) Test dependencies are installed with yarn install --frozen-lockfile only when steps.cache.outputs.cache-hit != 'true'; tests run via yarn test.
• 🟡 (12:37) Assistant’s security-review investigation found the workflows establish the intended trusted-checkout and ci-ready handoff, but deferred judgment pending review of the new attestation and authorization modules against every live-state check, workflow call site, race path, and cleanup path.