docs(security): add "Release path & compromise scope" appendix (supersedes #232) - #240
Merged
Merged
Conversation
Rescopes the deliverable from #232 down to the load-bearing bits: the DbClient-specific facts a maintainer would need at 2am if the release identity is compromised. The generic runbook material (rotate credentials, revoke OAuth apps, unlist packages, publish advisories, consumer-notification template) is dropped from this repo — GitHub's and NuGet's own docs update faster than a checked-in runbook, and duplicating that content across 25+ downstream repos would drift immediately. Appendix covers: - Release path: OIDC / NuGet Trusted Publishing (no long-lived API key exists; any legacy key is an immediate delete target). - No fallback (compromise = GitHub-account-level incident). - Owner + downstream-consumer status. - Package coordinates for unlisting. Fleet-canonical full runbook is tracked separately at Chris-Wolfgang/repo-template#430 (per #151 AC). Supersedes #232. Refs #151. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This was referenced Jul 13, 2026
There was a problem hiding this comment.
Pull request overview
Adds a short, DbClient-specific appendix to SECURITY.md describing how releases are published (OIDC / NuGet Trusted Publishing) and what a maintainer should assume/verify if the release identity is compromised, while pointing generic incident-response guidance to the fleet-canonical tracking issue.
Changes:
- Add “Release path & compromise scope” section to
SECURITY.md. - Document the release workflow’s Trusted Publishing/OIDC posture, ownership, and NuGet package coordinates.
- Link to the fleet-canonical runbook tracking issue to avoid duplicating generic IR steps.
Two findings, both accuracy-of-claim issues: 1. "No long-lived NUGET_API_KEY exists" was imprecise. The release workflow does bind an env var literally named NUGET_API_KEY — the value is minted per-run by NuGet/login@v1 via OIDC and passed to `dotnet nuget push`. That's ephemeral, not a persistent secret, but the earlier wording read as "the string 'NUGET_API_KEY' does not appear anywhere," which is wrong. Rewrote to describe what actually happens (ephemeral OIDC-minted push token, no long-lived secret dependency) and to acknowledge that keys can still exist on the NuGet account independently of CI — check-and- delete-anything-unrecognized becomes an incident action rather than a claim about repo state. 2. "Downstream consumers: none inside the Wolfgang.* org today" was a permanent-sounding statement that would rot the moment a new consumer landed. Qualified to "none known at time of writing" and added a re-check pointer (dotnet-outdated, GH code-search, NuGet Used By list) so the incident handler verifies rather than trusting a possibly-stale claim. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Owner
Author
|
Both findings addressed in f1ccd16:
Both threads resolved. |
This was referenced Jul 15, 2026
This was referenced Jul 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #232. Refs #151.
Rescopes the deliverable from the DR-runbook PR (#232) down to what's actually load-bearing for this repo: the ~10 DbClient-specific facts a maintainer would need at 2am if the release identity is compromised.
Dropped from the previous PR (moved to the fleet canonical at Chris-Wolfgang/repo-template#430 — will be canonicalized once, synced to every downstream):
Those are generic and duplicated 25× across the fleet would drift within a year. GitHub and NuGet's own docs update faster than a checked-in runbook.
Kept (this PR):
Docs-only.
Post-merge: close #232 without merging.