Document GitHub issue activity builds

[lox]

Why

Native GitHub issue builds differ from issue-comment commands and have security and execution semantics that pipeline authors need before opting in. In particular, public authors can trigger builds, workflow code comes from an immutable default-branch commit, and third-party automation can create loops.

Related server support: https://github.com/buildkite/buildkite/pull/32958

What

Document the gated, default-off pipeline setting, supported activity types and unsupported filters, immutable default-branch resolution, rebuild and trigger provenance, public-author trust boundary, quota controls, token recursion behavior, and the distinction from issue-comment commands.

[buildsworth-bk-app]

The opt-in instructions omit provider and control prerequisites, and the public-author security contract needs the workflow-permission and loop-suppression behavior corrected. I left one smaller environment-reference omission inline.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 21357, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

About buildsworth

Model: gpt-5.6-sol with xhigh thinking.

How to request a review: Comment @buildsworth-bk review on the PR, or request buildsworth-bk as a reviewer.

Risk labels (how buildsworth classifies risk) — buildsworth classifies risk itself from the diff. Unless repository policy already allows L2 approval, grant it by mentioning @buildsworth-bk (see approval ceiling and L2 approval grant):

• L1 — Low risk (dep bumps, docs/copy, lockfiles, small presentational fixes). buildsworth may approve by default.
• L2 — Standard risk (new UI, additive API fields, refactors). Approved only when repository policy or a verified grant allows it; otherwise comment-only.
• L3 — High risk (auth, migrations, payments, secrets, perf-critical paths). Human review always required.

Previous concerns have been addressed.

[buildsworth-bk-app]

The previous blocking concerns are fixed. I left one non-blocking environment-reference gap in the existing thread.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 21386, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[lox]

🤖 Closing this duplicate in favor of the existing private documentation PR, buildkite/docs-private#2034, which now contains the complete reviewed documentation and will follow the private-to-public docs workflow.