[codex] Harden Actions runtime boundaries (#213)

* Harden Actions runtime boundaries

* Document protected runner requirements

---------

Co-authored-by: Zac Davies <zachary.davies+data@databricks.com>

Author: zacdav-db

.github/workflows/pkgdown.yaml

@@ -17,6 +17,9 @@ jobs:
     environment: runtime
     permissions:
       contents: write # Deploy pkgdown output to the gh-pages branch.
+    # This protected runner is acceptable only for privileged triggers above
+    # (push to protected branches, release publication, or manual dispatch).
+    # Do not add pull_request, issue_comment, or other untrusted triggers here.
     runs-on:
       group: databrickslabs-protected-runner-group
       labels: linux-ubuntu-latest

SECURITY.md

@@ -28,6 +28,20 @@ Before enabling or changing internal runners, verify the environment still has
 required reviewers configured in GitHub repository settings under
 `Settings > Environments > runtime`.
 
+## Protected Runner Workflows
+
+The `pkgdown` workflow may use `databrickslabs-protected-runner-group` with
+`contents: write` because it is limited to privileged triggers: protected-branch
+`push`, release publication, and manual dispatch. The runner group configuration
+must remain locked down:
+
+- Only trusted repositories may target the runner group.
+- Workflows using the runner group must not add `pull_request`, `issue_comment`,
+  `pull_request_target`, `workflow_run`, or other externally influenced triggers.
+- Jobs using the runner group must continue to declare the `runtime` environment
+  when they execute repository code with runtime secrets or write tokens.
+- Changes to protected-runner workflows require CODEOWNERS review.
+
 ## Pull Request Comment Commands
 
 The `/document` and `/style` issue-comment commands fetch the pull request branch