Fork-Safe Flexport Contract CI

Overview

The required CI lane must run without Flexport secrets and remain safe for forks. Live verification belongs in a protected, non-fork, read-only lane with explicit environment approval.

Prerequisites

• Sanitized REST, MCP, OAuth-error, and webhook fixtures
• CI permissions model and fork-event policy
• Optional test credential approved through Flexport/account ownership

Instructions

Step 1: Build the required lane

Validate schemas, tolerant additive fields, pagination, error classification, webhook raw-body signatures, and mutation guards entirely from fixtures.

Step 2: Test secret absence