From 3a152e996c7c3a0e0ff9889920cff9776a00afda Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 4 Jul 2026 18:26:39 +0000
Subject: [PATCH 1/3] Initial plan


From 4183d3d5fd80ea96abf4e7cc7c5e4efe12807cce Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 4 Jul 2026 18:27:32 +0000
Subject: [PATCH 2/3] Restrict self-hosted runner job to trusted events only

---
 .github/workflows/checkSketches.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/checkSketches.yml b/.github/workflows/checkSketches.yml
index a1e8a972..19752d89 100644
--- a/.github/workflows/checkSketches.yml
+++ b/.github/workflows/checkSketches.yml
@@ -1,6 +1,11 @@
 name: check sketches
 
-on: [pull_request, push]
+on:
+  pull_request:
+  push:
+    branches:
+      - ch55xduino
+  workflow_dispatch:
 
 jobs:
 
@@ -59,6 +64,9 @@ jobs:
         path: compiled_hex.tar
   
   real_hardware_test_on_self_hosted_runner:
+    # Only run on trusted events (push to default branch or manual dispatch) to prevent
+    # untrusted PR code from executing on the self-hosted runner.
+    if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
     needs: arduino-cli_compile_all
     runs-on: self-hosted
     

From f68ac95303346b72dda2eace2b1b46d6de93f958 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 4 Jul 2026 18:28:19 +0000
Subject: [PATCH 3/3] Add minimal permissions block to limit GITHUB_TOKEN scope

---
 .github/workflows/checkSketches.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/checkSketches.yml b/.github/workflows/checkSketches.yml
index 19752d89..1eeb3059 100644
--- a/.github/workflows/checkSketches.yml
+++ b/.github/workflows/checkSketches.yml
@@ -7,6 +7,9 @@ on:
       - ch55xduino
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
 
   check_clang: