From 3086018e00244db7b3de00cb8d8ef6fd4be476d4 Mon Sep 17 00:00:00 2001
From: Dheeraj Pannala <12496535+DheerajPannala@users.noreply.github.com>
Date: Thu, 15 Oct 2026 16:30:32 +0100
Subject: [PATCH 1/2] ci: don't expose AZURE_OPENAI_API_KEY to pull request
 runs

Run the integration-test step only on push. pull_request runs execute PR-authored Jest config and tests, so they must not receive repository secrets (CWE-522).

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bde58a51-73ec-4b37-b60a-0b499ca60eb0
---
 .github/workflows/ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 36513d37..da52fb28 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -95,6 +95,8 @@ jobs:
       run: npm test
 
     - name: Run integration tests
+      # Only run after merge: pull_request runs execute unreviewed code, which must not receive repository secrets.
+      if: github.event_name == 'push'
       env:
         AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }}
         AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}

From ab250a616088aa97465aca255010fd6be998bd4e Mon Sep 17 00:00:00 2001
From: Dheeraj Pannala <12496535+DheerajPannala@users.noreply.github.com>
Date: Tue, 27 Oct 2026 11:19:15 +0000
Subject: [PATCH 2/2] ci: run integration tests in a push-only job bound to a
 protected environment

A step-level if: is not a boundary: pull_request runs use the PR's own workflow file, so an author could drop the condition. Move the integration tests into a push-only job that uses the integration-tests environment, so the key can live in an environment secret limited to main.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: bde58a51-73ec-4b37-b60a-0b499ca60eb0
---
 .github/workflows/ci.yml | 69 +++++++++++++++++++++++++++++++++-------
 1 file changed, 57 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cef4fafa..09a42af5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -94,18 +94,6 @@ jobs:
     - name: Run tests
       run: npm test
 
-    - name: Run integration tests
-      # Only run after merge: pull_request runs execute unreviewed code, which must not receive repository secrets.
-      if: github.event_name == 'push'
-      env:
-        AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }}
-        AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}
-        AZURE_OPENAI_DEPLOYMENT: ${{ vars.AZURE_OPENAI_DEPLOYMENT }}
-        AZURE_OPENAI_API_VERSION: ${{ vars.AZURE_OPENAI_API_VERSION }}
-        ENABLE_OBSERVABILITY: ${{ vars.ENABLE_OBSERVABILITY }}
-      run: |
-        npm run test:integration
-
     - name: Pack packages
       run: npm run pack
 
@@ -125,3 +113,60 @@ jobs:
     #   run: npm publish
     #   env:
     #     NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+  integration-tests:
+    name: Integration tests
+    needs: [nodejs-sdk]
+    # Pull request workflows can be edited by the PR author, so the Azure OpenAI key lives in the
+    # integration-tests environment, which only allows deployments from main.
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    environment: integration-tests
+    permissions:
+      contents: read
+
+    strategy:
+      matrix:
+        node-version: ['18', '20']
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      with:
+        fetch-depth: 0
+
+    - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
+      name: Install pnpm
+      with:
+        run_install: false
+
+    - name: Set up Node.js ${{ matrix.node-version }}
+      uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
+      with:
+        node-version: ${{ matrix.node-version }}
+        cache: 'pnpm'
+        cache-dependency-path: '**/pnpm-lock.yaml'
+
+    - name: Setup pnpm
+      uses: pnpm/action-setup@a3252b78c470c02df07e9d59298aecedc3ccdd6d # v3.0.0
+      with:
+        version: 10.20.0
+
+    - name: Install dependencies
+      run: pnpm i
+
+    - name: Set version with Nerdbank.GitVersioning
+      run: node setVersion.js
+
+    - name: Build package
+      run: npm run build
+
+    - name: Run integration tests
+      env:
+        AZURE_OPENAI_API_KEY: ${{ secrets.AZURE_OPENAI_API_KEY }}
+        AZURE_OPENAI_ENDPOINT: ${{ vars.AZURE_OPENAI_ENDPOINT }}
+        AZURE_OPENAI_DEPLOYMENT: ${{ vars.AZURE_OPENAI_DEPLOYMENT }}
+        AZURE_OPENAI_API_VERSION: ${{ vars.AZURE_OPENAI_API_VERSION }}
+        ENABLE_OBSERVABILITY: ${{ vars.ENABLE_OBSERVABILITY }}
+      run: |
+        npm run test:integration