fix(operations): harden runner-audit first-run credential contract - #402
Merged
seonghobae merged 30 commits intoAug 16, 2026
Merged
Conversation
Name capability-file ingress, exact token redaction, and started_at losing assignment authority in Unreleased so operators can apply the hardened production command without treating PASS as merge authority. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Guard empty-secret redaction, keep test gh shims from interpolating tokens, and tell operators that echo-style newlines fail closed. Co-authored-by: Seongho Bae <seonghobae@users.noreply.github.com>
Preserve the protected-main workflow-registry disablement slice while retaining runner-assignment credential hardening and both Unreleased entries.
seonghobae
marked this pull request as ready for review
August 16, 2026 18:02
Contributor
Author
|
Bugbot is not enabled for your account, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
seonghobae
deleted the
cursor/bc-c0f43bb3-1fdc-4d79-b7a2-caeab65f19ca-647b
branch
August 16, 2026 20:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
Land #401 plus the first-run operator contract that review found on
64c6213.#401 already implements capability-file ingress, exact token redaction, and
started_atlosing assignment authority. An operator who writes the capability file withechoorprintf '%s\n'still fails closed on a trailing newline and does not see the required Actions workflow-run/job read scope. Empty-secret redaction was also a reuse landmine, and the testghshims interpolated expected tokens into shell.What to do with this PR
Prefer this branch over merging #401 at
64c6213or #394 atf4a4bc9. This head is #401 plus one first-run hygiene commit (fddec97). Do not merge #401 or #394 once this PR exists unless those heads are fast-forwarded to include this commit.Operator next action after merge
printf '%s'into an owner-only file.NOEMA_MAINTAINER_TOKEN_PATHto that file. Do not exportGH_TOKEN.npm run operations:runner-assignmentagainst explicit current-head run IDs.PASSas runner-assignment evidence only. It is not required Check, formal review, or merge authority.Test-first evidence
Local Node 24.19.0 / npm 11.17.0: eight runner-assignment and credential-ingress files, 50 tests passed;
tsc --noEmitpassed.Added coverage:
echo/printf '%s\n'as the wrong write path and cites GitHub fine-grained PAT permissionsAuthority boundary
This does not close issue #30. It does not change GitHub permissions, reviewer/maintainer identities, workflow authority, release/deployment authority, or any central repository. Exact-head checks on this successor are not GREEN until they terminate on this SHA.
Related: #401, #394, #30.