Event-Driven Private Content Intake with CI Dispatch

A source repository may contain private editorial context that a hosted CI runner must never read. The integration keeps source evaluation local, stages only safe private drafts in the destination project, and dispatches CI after that boundary.

Eligibility is a policy gate

An article must be published, explicitly approved, have at least two evidence sources, and directly concern supply-chain security, cybersecurity, AI/data infrastructure, or cloud/platform operations. A general technology article is not enough.

The event handler first runs the source sync in check mode. If nothing qualifies, it exits successfully with a no-ready result. That behavior matters for automation: “nothing to do” is not an incident.

Keep drafts private by construction

Eligible content generates a Korean source draft, an English assisted translation draft, and a thumbnail, all with published: false. Post and publication audits run before any repository event is sent. The hosted workflow sees only staged destination files, never the private source checkout.

Dispatch is optional and explicit. The handler requires --dispatch and uses the one approved destination repository. This avoids scheduled polling and cross-repository checkout credentials.

Verify the negative path

The local run found one approved technology article but excluded it because it did not meet the security/infrastructure policy. Zero drafts were produced, the process returned a no-ready result, and no dispatch was sent. A reliable event pipeline must prove that it can refuse input as carefully as it can process it.