# Commit the reviewed authorization-contract.py and access-fixture.py in ci/.
name: API authorization regression
on: [push, pull_request]
permissions:
  contents: read
jobs:
  owner-isolation:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          persist-credentials: false
      - name: Verify the fixture permits owners and rejects cross-owner reads
        run: python3 ci/authorization-contract.py --mode fixed
      - name: Prove the test detects a broken ownership check
        shell: bash
        run: |
          result=0
          python3 ci/authorization-contract.py --mode vulnerable || result=$?
          test "$result" -eq 1