Canva Fork-Safe CI Contract Lane

Overview

Keep pull-request validation offline and deterministic. Reserve one minimal live read for trusted commits after environment protection, without rotating production tokens inside CI.

Prerequisites

• Existing test framework and repository-defined command
• Pinned Canva OpenAPI snapshot or validated fixtures
• Protected environment with dedicated test integration and cleanup owner

Instructions

Step 1: Inventory workflow trust

Use Read and Grep to map pull-request events, fork execution, secret references, generated clients, artifact uploads, and any code path that creates Canva resources.

Step 2: Define offline contracts