Bright Data CI Contract Lane

Overview

Keep pull-request verification credential-free and deterministic. Test the Bright Data adapter against fixtures by default, then place any necessary live probe in an independent protected job with a dedicated credential, approved target, and one-operation budget.

Prerequisites

• A repository test command and representative sanitized success and failure fixtures
• The CI workflow and Bright Data adapter paths
• Maintainer approval before creating an optional live lane

Instructions

Step 1: Audit the workflow boundary

Read the workflow and Grep for secrets, direct provider calls, artifact uploads, and execution from untrusted forks. Map every test to either the offline contract lane or the protected live lane.

Step 2: Add the required offline lane

Write or Edit the workflow so the required job runs npm ci and npm run test:brightdata:contract with BRIGHTDATA_MODE=fixture. Cover success, authentication denial, policy denial, 429, provider 5xx, malformed output, and redaction without network access.

Step 3: Isolate the optional live lane

Make the live job independent of fork and pull-request execution. Require a protected environment, maintainer authorization, an approved public target, a dedicated least-privilege secret, a single-operation ceiling, a timeout, and redacted logs.

Step 4: Prove negative behavior

Use Bash(npm:*) to run contract tests with missing and sentinel credentials. Confirm the offline job remains green without secrets and that failure artifacts contain neither credentials nor collected payloads.

Tool Discipline

Use Read and Grep to inspect workflows, adapters, and secret references. Use Write and Edit for the workflow, fixtures, tests, and runbook. Use Bash(npm:*) only for dependency installation and repository test commands; do not use it to make live Bright Data requests.

Output

• A required credential-free offline contract job
• An optional, independent protected live-probe job
• Negative-test and redaction receipts

Examples

A forked pull request runs synthetic proxy and snapshot fixtures only. A maintainer-triggered release workflow may perform one approved provider operation through a protected environment and records only status, latency, and redacted error class.

Error Handling

Failure	Meaning	Response
A fork can access a provider secret	Trust boundary is broken	Disable the live job and remove the secret exposure
Offline tests require the network	Contract lane is nondeterministic	Replace provider traffic with sanitized fixtures
A live artifact contains raw output	Data boundary is broken	Delete the artifact and retain only redacted metrics

Resources

• Proxy error catalog
• Acceptable use policy
• Proxy API authentication
• Asynchronous scraper requests