fix(security): restack maintainer token capability ingress on current main

[seonghobae]

Purpose

Restack the bounded Maintainer App credential-ingress hardening from #311 onto the current protected main without carrying stale ancestry or predecessor validation evidence.

Exact construction

• protected main immediately before construction: f1846b322290a7ddefe20a6f835884e7c9a0f6a2;
• stable source fix(security): move maintainer GitHub tokens behind capability files #311 exact head: cd4288300e3753b9ae635d8d3b67b0f663c0544d;
• successor exact head: b08b48fc545a7d9f5c2c30fed7d9610fa93f8f64;
• successor ancestry: 1 commit ahead / 0 behind, merge base exactly the protected-main SHA above;
• the nine exact source-head blobs were overlaid onto the current protected-main tree. A fresh comparison from fix(security): move maintainer GitHub tokens behind capability files #311's old base to current main showed no overlap with these nine paths, preserving intervening protected-main bytes.

Changed paths are limited to:

• .github/workflows/hourly-commercial-readiness.yml
• .github/workflows/maintainer-app-readiness.yml
• scripts/hourly-commercial-readiness.mjs
• scripts/lib/delegated-github-token.mjs
• scripts/main-governance-audit.mjs
• test/github-credential-capability-ingress.test.ts
• test/hourly-commercial-readiness-toolchain-integrity.test.ts
• test/main-governance-audit-script.test.ts
• test/workflow-readiness.test.ts

Security change

The two Noema automation scripts no longer source the delegated Maintainer App bearer token directly from their ambient Node process environment. Trusted workflow bootstrap shell writes the short-lived token to a restrictive runner-temp capability file (umask 077), unsets the bootstrap environment value, registers cleanup, and passes only the capability-file path into the Node process. The helper fails closed for missing, unreadable, empty, or control-bearing capability contents; only the bounded gh subprocess environment receives GH_TOKEN.

This does not claim organization-wide secret storage, live Maintainer App provisioning, production deployment, or broader issue #111 completion. It modifies only Noema and does not modify central .github, naruon, contextual-orchestrator, branch policy, reviewer authority, releases, deployments, or outbound licensing.

Evidence boundary

No CI, scanner, review, coverage, model, or production evidence from #311 transfers to this successor. Keep this PR Draft until this unchanged exact head has fresh terminal-success application ci, reviewer-ci, protected-base-eligible central Security Scan, exact 100% owned-production statement/branch/function/line coverage with realistic tests, and zero valid unresolved findings. Pending/queued/skipped/absent/neutral/failed/cancelled/stale/predecessor/status-only/model-only/rate-limited evidence is non-passing.

The current live Noema ruleset requires the central Security Scan workflow and does not add an independent formal-approval requirement. #311 should be closed as superseded only after this successor reaches protected-main truth.

Summary by CodeRabbit

• 보안 강화

  • 유지보수 및 거버넌스 자동화에서 인증 토큰을 임시 파일로 안전하게 전달합니다.
  • 토큰 파일의 접근 권한을 제한하고, 실행 후 파일과 환경 변수 정보를 정리합니다.
  • 유효하지 않거나 누락된 토큰 파일을 감지해 처리를 중단합니다.

• 테스트

  • 토큰 전달, 파일 권한, 정리 절차 및 오류 상황에 대한 검증을 강화했습니다.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 095976d6-dafb-43f3-8f13-ada1e500d29d

📥 Commits

Reviewing files that changed from the base of the PR and between f1846b3 and b08b48f.

📒 Files selected for processing (9)

• .github/workflows/hourly-commercial-readiness.yml
• .github/workflows/maintainer-app-readiness.yml
• scripts/hourly-commercial-readiness.mjs
• scripts/lib/delegated-github-token.mjs
• scripts/main-governance-audit.mjs
• test/github-credential-capability-ingress.test.ts
• test/hourly-commercial-readiness-toolchain-integrity.test.ts
• test/main-governance-audit-script.test.ts
• test/workflow-readiness.test.ts

---

📝 Walkthrough

Walkthrough

GitHub 토큰 전달을 환경 변수에서 제한된 임시 파일 기반 방식으로 변경했습니다. 토큰 로더는 입력과 내용을 검증합니다. 감사 및 readiness 스크립트는 명시적 토큰을 GitHub CLI에 전달합니다. 워크플로와 테스트가 이 경로를 검증합니다.

Changes

위임 토큰 유입

Layer / File(s)	Summary
토큰 로더와 소비 스크립트 scripts/lib/delegated-github-token.mjs, scripts/main-governance-audit.mjs, scripts/hourly-commercial-readiness.mjs	readDelegatedGithubToken이 지정된 파일에서 토큰을 읽습니다. 경로 누락, 읽기 실패, 빈 토큰, 제어 문자를 거부합니다. 감사 및 상업 readiness 스크립트는 읽은 토큰을 GitHub CLI 실행 환경에 전달합니다.
워크플로 토큰 임시 파일 전달 .github/workflows/hourly-commercial-readiness.yml, .github/workflows/maintainer-app-readiness.yml	유지보수 단계가 umask 077로 임시 토큰 파일을 생성합니다. 환경 변수에서 토큰을 제거하고 종료 시 파일을 삭제합니다. 스크립트에는 NOEMA_MAINTAINER_TOKEN_PATH를 전달합니다.
자격 증명 유입 검증 test/github-credential-capability-ingress.test.ts, test/hourly-commercial-readiness-toolchain-integrity.test.ts, test/main-governance-audit-script.test.ts, test/workflow-readiness.test.ts	토큰 로딩 실패 조건과 파일 권한, 환경 변수 제거, 종료 정리, 직접적인 GH_TOKEN 사용 금지를 검증합니다.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Merge Risk: ⚪ Minimal · up to b08b4

The PR narrows delegated Maintainer App token exposure by using a temporary capability file and fail-closed handling. No actionable merge-blocking risk remains beyond normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant TokenFile
  participant ReadinessScript
  participant GitHubCLI
  GitHubActions->>TokenFile: 제한된 권한으로 Maintainer App 토큰 저장
  GitHubActions->>GitHubActions: 토큰 환경 변수 제거
  GitHubActions->>ReadinessScript: NOEMA_MAINTAINER_TOKEN_PATH 전달
  ReadinessScript->>TokenFile: 위임 토큰 읽기
  ReadinessScript->>GitHubCLI: 읽은 토큰으로 GitHub API 명령 실행
  GitHubActions->>TokenFile: 종료 시 파일 삭제

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	제목은 Maintainer App 토큰의 보안 자격 증명 유입 변경과 현재 main에 대한 재적용을 정확히 요약합니다.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/github-token-capability-ingress-f1846b

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}