fix(ci): prevent branch-selected installed-gate workflows

[luvs01]

Motivation

• A manual workflow_dispatch trigger allowed a caller to select a branch whose workflow YAML would run on persistent self-hosted runners, enabling a collaborator-controlled workflow to execute arbitrary steps on privileged hosts.
• The installed-artifact gate runs on maintainer-registered self-hosted GUI machines and performs privileged operations (including noninteractive sudo dpkg -i on Linux), so the workflow must be loaded from an immutable/default ref rather than an attacker-controlled branch.
• The change locks the dispatch routing to a repository-side, default-branch-loaded event and preserves the existing required-review environment and protected dev checkout as the enforcement surface the repo controls.

Description

• Replaced the branch-selectable workflow_dispatch trigger with a typed repository_dispatch event (types: [desktop-installed-gate]) so GitHub loads the workflow from the repository default branch.
• Mapped all previously inputs-based references to github.event.client_payload (release/version/hook names) and adjusted the concurrency group to use github.event.client_payload.version so payload-driven behavior remains available but is loaded from the default ref.
• Kept the required-review environment, actions/checkout pinned ref: dev, platform matrix, and hook-name boundary intact so the gate logic and protections remain the same at runtime.
• Updated the CI unit test tests/ci-workflows/installed-gate-drivers.test.ts to assert the new repository_dispatch trigger and to extract the event payload keys from client_payload usage in the workflow file.

Testing

• Ran the focused workflow tests with mise exec bun@latest -- bun test tests/ci-workflows/installed-gate-drivers.test.ts, which passed (49 passed).
• Ran the repository privacy scan with mise exec bun@latest -- bun run privacy:scan, which passed.
• Exercised the pre-push local checks with mise exec bun@latest -- bun run prepush; typecheck and GUI lint passed but the full-suite phase encountered unrelated environment-local proxy HTTP 403s (external environment routing) and was stopped after confirming the recurring environmental failures, so unrelated full-suite failures are not attributed to this change.

---

Codex Task

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 36fdbd10-dd03-4278-822c-b14ff1400ddc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T06:28:20.958566Z	9899598	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[devin-ai-integration]

Devin Review found 3 potential issues.

[devin-ai-integration]

🔍 Explicit security review remains required

This change affects a GitHub Actions security boundary targeting privileged self-hosted runners. Repository policy requires explicit security review before merge.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

Fixed in 5b89c7d. The payload-key assertion now requires the exact accepted key set (version, from-version, and the six hook names) rather than checking that a few names merely appear — a dropped required key or an incidental extra reference both fail the test. A new test also asserts the dispatch contract is enforced: a validate job on a hosted runner checks every payload field, and each privileged gate job declares needs: validate.

[devin-ai-integration]

Fixed in 5b89c7d. Added a validate job on ubuntu-latest (outside the gated environment) that runs before any privileged job is scheduled: version/from-version must be strict semver and every supplied hook field must be a plain file name — the same grammar parseGateArguments enforces. All three gate jobs now carry needs: validate, so a malformed dispatch fails fast instead of occupying self-hosted runners or consuming a maintainer approval.

[devin-ai-integration]

Not applicable for this repository: the default branch is dev, not main (git ls-remote --symref origin HEAD → refs/heads/dev). This PR merges into dev, so the workflow lands on the default branch the moment it merges and repository_dispatch resolves it normally — no separate promotion is needed.