security: bind Cloudflare deploys to protected main

[lawrencecchen]

Summary

• Add a read-only source authorization job for Cloudflare workflow events.
• Permit deployment secrets only for the canonical protected main ref, exact workflow ref, and matching current main commit SHA.
• Check out the authorized commit in every verify/deploy job, pin all actions to immutable SHAs, add positive GitHub-hosted runner guards, least-privilege contents: read, timeouts, and strict shell mode.
• Keep pull request verification read-only and fail closed for manual dispatches from branches or tags. Release-tag support is intentionally separate.
• Add behavior tests for accepted pull requests, protected main, wrong refs, unprotected main, SHA/workflow mismatches, malformed/API-error/oversized responses, and wrong repositories.

Repository settings prerequisite

Configure required reviewers and branch restrictions for subrouter-staging and subrouter-production in GitHub environment settings. YAML cannot create environment protection rules. This PR only ensures an approved deployment cannot receive secrets from an arbitrary ref.

Testing

• bash tests/test_cloudflare_dispatch_guard.sh
• bash -n .github/scripts/authorize-cloudflare-deploy.sh tests/test_cloudflare_dispatch_guard.sh
• shellcheck --shell=bash .github/scripts/authorize-cloudflare-deploy.sh tests/test_cloudflare_dispatch_guard.sh
• actionlint -shellcheck .github/workflows/cloudflare-do.yml
• git diff --check

Commits

The first commit adds the behavior tests and is expected to fail without the guard. The second commit implements the guard.

---

Summary by cubic

Previously, any push or manual dispatch on main could deploy to Cloudflare. The workflow now authorizes the source before any verify/deploy job, checks out that authorized commit, and fails closed for branches, tags, unprotected main, or workflow ref/SHA mismatches; pull request verification stays read-only and never authorizes a deploy.

Migration

• Configure required reviewers and branch restrictions for subrouter-staging and subrouter-production in GitHub environment settings; YAML cannot create these protection rules.

^{Written for commit 407b0e6. Summary will update on new commits.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 13014298-1821-41a0-a7c3-af40e6e264e0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document v2.2 and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}