From b6b893c77edaceb28a99bf31c46697a59cab3ed1 Mon Sep 17 00:00:00 2001
From: Emanuel Kayowuan <191248002+kyy8-L@users.noreply.github.com>
Date: Thu, 22 Oct 2026 12:51:51 +0700
Subject: [PATCH] Harden Java PR CI: gate self-hosted (credentialed) jobs
 behind an approval environment

The Java PR workflow runs java_build, java_unit_tests and the integration
(smoke/full) jobs on the self-hosted [self-hosted, it] runners, which hold Google
Cloud credentials for the cloud-teleport-testing project (the IT steps pass
--it-project=cloud-teleport-testing with no google-github-actions/auth step, so
the runner itself provides the credentials). These jobs run PR code
(./cicd/run-build, run-unit-tests, run-it-*) with no gate restricting fork PRs,
so a pull request's code executes on the credentialed runner.

Add `environment: fork-ci-approval` to java_build. Every other self-hosted `it`
job transitively `needs: java_build`, so one approval gate at the root holds the
whole chain until a maintainer approves the current commit. Configure required
reviewers on the fork-ci-approval environment to activate it; until then the
environment imposes no gate, so this change is behavior-neutral.
---
 .github/workflows/java-pr.yml | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/.github/workflows/java-pr.yml b/.github/workflows/java-pr.yml
index b31c0e3c2e..c8c0485d2a 100644
--- a/.github/workflows/java-pr.yml
+++ b/.github/workflows/java-pr.yml
@@ -96,6 +96,14 @@ jobs:
     name: Build
     timeout-minutes: 60
     runs-on: [self-hosted, it]
+    # Gate untrusted PR code before it runs on the credentialed self-hosted
+    # runner. Every other [self-hosted, it] job (unit tests -> smoke -> IT)
+    # transitively `needs: java_build`, so requiring approval here holds the
+    # whole chain until a maintainer approves the current commit. Configure
+    # required reviewers on the `fork-ci-approval` environment in repo settings
+    # to activate this (until then the environment imposes no gate, so merging
+    # this PR is behavior-neutral).
+    environment: fork-ci-approval
     steps:
       - name: Checkout Code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1