make test suite more secure

.github/workflows/test-suite.yml

@@ -1,47 +1,63 @@
 name: CORE Test Suite Validation
 on:
+  workflow_run:
+    workflows: ["Upload PR Artifact"]
+    types: [completed]
   workflow_dispatch:
     inputs:
       pr_number:
         description: "PR number to test (for forked repositories) (leave empty for current branch)"
         required: false
         type: string
-  pull_request_target:
   push:
     branches:
       - main
 
 env:
   DATASET_SIZE_THRESHOLD: 1000000000
+
 jobs:
   validate:
     runs-on: ubuntu-latest
+    # Only run if the workflow_run was successful or if manually triggered/pushed
+    if: |
+      github.event_name == 'push' || 
+      github.event_name == 'workflow_dispatch' || 
+      github.event.workflow_run.conclusion == 'success'
     steps:
-      - name: Get Engine Changes
+      - name: Download PR engine artifact
+        if: github.event_name == 'workflow_run'
+        uses: actions/download-artifact@v8
+        with:
+          name: pr-engine-${{ github.event.workflow_run.pull_requests[0].number }}
+
+      - name: Checkout current branch (for push/manual)
+        if: github.event_name != 'workflow_run'
         uses: actions/checkout@v6
         with:
-          ref: ${{ (inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number)) || github.event.pull_request.head.sha || github.ref }}
+          ref: ${{ (inputs.pr_number && format('refs/pull/{0}/head', inputs.pr_number)) || github.ref }}
+
       - name: Get Test Suite Repository
         uses: actions/checkout@v6
         with:
           repository: cdisc-org/CORE_Test_Suite
           path: CORE_Test_Suite
           token: ${{ secrets.ACCESS_TOKEN }}
 
       - name: Set up Python
         uses: actions/setup-python@v6
         with:
           python-version: "3.12"
       - name: Install dependencies
         run: |
           pip install -r requirements.txt
       - name: Update rules cache
         env:
           CDISC_LIBRARY_API_KEY: ${{ secrets.CDISC_LIBRARY_API_KEY }}
         run: |
           python core.py update-cache
 
       #############################
       # CORE TEST SUITE VALIDATION
       #############################
 
@@ -55,34 +71,34 @@
         id: pandas_run
         env:
           CDISC_LIBRARY_API_KEY: ${{ secrets.CDISC_LIBRARY_API_KEY }}
         continue-on-error: true
         run: |
           python core.py validate -s sdtmig -v 3-3 ${{ env.RULE_LIST }} -d CORE_Test_Suite/data -dxp CORE_Test_Suite/data/Define.xml -of json -o CORE_Test_Suite/pandas-results -l info || true
 
           if [ -f "CORE_Test_Suite/pandas-results.json" ]; then
             echo "pandas_success=true" >> $GITHUB_OUTPUT
             echo "## Pandas Validation" >> $GITHUB_STEP_SUMMARY
             echo "✅ **Success**: Validation completed successfully" >> $GITHUB_STEP_SUMMARY
             python CORE_Test_Suite/scripts/validation_summary.py CORE_Test_Suite/pandas-results.json >> $GITHUB_STEP_SUMMARY
           else
             echo "Failed to generate pandas-results.json"
             echo "pandas_success=false" >> $GITHUB_OUTPUT
             echo "## Pandas Validation" >> $GITHUB_STEP_SUMMARY
             echo "❌ **Failed**: No results file was generated" >> $GITHUB_STEP_SUMMARY
           fi
 
       - name: Pandas CORE comparison with template
         if: steps.pandas_run.outputs.pandas_success == 'true'
         continue-on-error: true
         run: |
           python CORE_Test_Suite/scripts/comparison.py CORE_Test_Suite/pandas-results.json CORE_Test_Suite/CORE-Report.json CORE_Test_Suite/pandas_comparison.xlsx --mode test --json-output CORE_Test_Suite/pandas_comparison.json
           echo "pandas_diff=$?" >> $GITHUB_ENV
 
           PANDAS_EXIT_CODE=$?
           echo "pandas_diff=$PANDAS_EXIT_CODE" >> $GITHUB_ENV
           if [ $PANDAS_EXIT_CODE -eq 0 ]; then
             echo "Pandas comparison completed successfully (no differences)"
           else
             echo "Pandas comparison found differences"
           fi
 
@@ -95,39 +111,39 @@
         id: dask_run
         continue-on-error: true
         env:
           DATASET_SIZE_THRESHOLD: 0
           CDISC_LIBRARY_API_KEY: ${{ secrets.CDISC_LIBRARY_API_KEY }}
         run: |
           python core.py validate -s sdtmig -v 3-3 ${{ env.RULE_LIST }} -d CORE_Test_Suite/data -dxp CORE_Test_Suite/data/Define.xml -of json -o CORE_Test_Suite/dask-results -l info || true
 
           if [ -f "CORE_Test_Suite/dask-results.json" ]; then
             echo "dask_success=true" >> $GITHUB_OUTPUT
             echo "## Dask Validation" >> $GITHUB_STEP_SUMMARY
             echo "✅ **Success**: Validation completed successfully" >> $GITHUB_STEP_SUMMARY
             python CORE_Test_Suite/scripts/validation_summary.py dask-results.json >> $GITHUB_STEP_SUMMARY
           else
             echo "Failed to generate dask-results.json"
             echo "dask_success=false" >> $GITHUB_OUTPUT
             echo "## Dask Validation" >> $GITHUB_STEP_SUMMARY
             echo "❌ **Failed**: No results file was generated" >> $GITHUB_STEP_SUMMARY  
           fi
       - name: Dask comparison script
         continue-on-error: true
         if: steps.dask_run.outputs.dask_success == 'true'
         run: |
           python CORE_Test_Suite/scripts/comparison.py CORE_Test_Suite/dask-results.json CORE_Test_Suite/CORE-Report.json CORE_Test_Suite/dask_comparison.xlsx --mode test --json-output CORE_Test_Suite/dask_comparison.json
           DASK_EXIT_CODE=$?
           echo "dask_diff=$DASK_EXIT_CODE" >> $GITHUB_ENV
           if [ $DASK_EXIT_CODE -eq 0 ]; then
             echo "Dask comparison completed successfully (no differences)"
           else
             echo "Dask comparison found differences"
 
       - name: Generate dask comparison summary
         if: steps.dask_run.outputs.dask_success == 'true'
         continue-on-error: true
         run: |
           python CORE_Test_Suite/scripts/compare_implementations.py CORE_Test_Suite/dask-results.json CORE_Test_Suite/CORE-Report.json CORE_Test_Suite/dask_comparison.json --github-step-summary $GITHUB_STEP_SUMMARY --mode test
 
       #################################
       # USDM TEST SUITE VALIDATION
@@ -139,30 +155,30 @@
           echo "USDM_RULE_LIST=$usdm_rules" >> $GITHUB_ENV
           echo "USDM rules: $usdm_rules"
 
       - name: Run USDM validation (Negative)
         id: usdm_neg
         continue-on-error: true
         run: |
           python core.py validate -s usdm -v 3-0 ${{ env.USDM_RULE_LIST }} -dp CORE_Test_Suite/usdm_data/USDM_Test_Suite_negative.json -of json -o CORE_Test_Suite/usdm_negative_report -l error || true
 
           if [ -f "CORE_Test_Suite/usdm_negative_report.json" ]; then
             echo "usdm_neg_success=true" >> $GITHUB_OUTPUT
             echo "## USDM Negative" >> $GITHUB_STEP_SUMMARY
             echo "**Success**: Negative test passed" >> $GITHUB_STEP_SUMMARY
             python CORE_Test_Suite/scripts/validation_summary.py CORE_Test_Suite/usdm_negative_report.json >> $GITHUB_STEP_SUMMARY
           else
             echo "usdm_neg_success=false" >> $GITHUB_OUTPUT
             echo "**Failed**: No results for negative test" >> $GITHUB_STEP_SUMMARY
           fi
 
       - name: Compare USDM negative result
         if: steps.usdm_neg.outputs.usdm_neg_success == 'true'
         continue-on-error: true
         run: |
           python CORE_Test_Suite/scripts/comparison.py CORE_Test_Suite/usdm_negative_report.json CORE_Test_Suite/USDM_Negative_Result.json CORE_Test_Suite/usdm_negative_comparison.xlsx --mode test --json-output CORE_Test_Suite/usdm_negative_comparison.json
           USDM_NEG_EXIT_CODE=$?
           echo "usdm_neg_diff=$USDM_NEG_EXIT_CODE" >> $GITHUB_ENV
           if [ $USDM_NEG_EXIT_CODE -eq 0 ]; then
             echo "USDM negative comparison completed successfully (no differences)"
           else
             echo "USDM negative comparison found differences"
@@ -174,29 +190,29 @@
         run: |
           python CORE_Test_Suite/scripts/compare_implementations.py CORE_Test_Suite/usdm_negative_report.json CORE_Test_Suite/USDM_Negative_Result.json CORE_Test_Suite/usdm_negative_comparison.json --github-step-summary $GITHUB_STEP_SUMMARY --mode test
 
       - name: Run USDM validation (Positive)
         id: usdm_pos
         continue-on-error: true
         run: |
           python core.py validate -s usdm -v 3-0 ${{ env.USDM_RULE_LIST }} -dp CORE_Test_Suite/usdm_data/USDM_Test_Suite_positive.json -of json -o CORE_Test_Suite/usdm_positive_report -l error || true
 
           if [ -f "CORE_Test_Suite/usdm_positive_report.json" ]; then
             echo "usdm_pos_success=true" >> $GITHUB_OUTPUT
             echo "## USDM Positive" >> $GITHUB_STEP_SUMMARY
             echo "**Success**: Positive test passed" >> $GITHUB_STEP_SUMMARY
             python CORE_Test_Suite/scripts/validation_summary.py CORE_Test_Suite/usdm_positive_report.json >> $GITHUB_STEP_SUMMARY
           else
             echo "usdm_pos_success=false" >> $GITHUB_OUTPUT
             echo "**Failed**: No results for positive test" >> $GITHUB_STEP_SUMMARY
           fi
 
       - name: Compare USDM positive result
         if: steps.usdm_pos.outputs.usdm_pos_success == 'true'
         continue-on-error: true
         run: |
           python CORE_Test_Suite/scripts/comparison.py CORE_Test_Suite/usdm_positive_report.json CORE_Test_Suite/USDM_Positive_Result.json CORE_Test_Suite/usdm_positive_comparison.xlsx --mode test --json-output CORE_Test_Suite/usdm_positive_comparison.json
           USDM_POS_EXIT_CODE=$?
           echo "usdm_pos_diff=$USDM_POS_EXIT_CODE" >> $GITHUB_ENV
           if [ $USDM_POS_EXIT_CODE -eq 0 ]; then
             echo "USDM positive comparison completed successfully (no differences)"
           else

.github/workflows/upload-pr-artifact.yml

@@ -0,0 +1,22 @@
+name: Upload PR Artifact
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  build-engine:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout PR code
+        uses: actions/checkout@v6
+
+      - name: Upload engine artifact
+        uses: actions/upload-artifact@v7
+        with:
+          name: pr-engine-${{ github.event.pull_request.number }}
+          path: .
+          retention-days: 1