Repository navigation
docs(wish): record release-manifest credential resolution (stable gate) - #2645
Conversation
The org-wide deploy-key ban made the ssh model unusable, and the fine-grained PAT that replaced it still could not push: the 'main' ruleset carried a pull_request rule with an empty bypass_actors list, so every direct push was rejected GH013 regardless of token scope. That froze the channel pointers from 2026-07-20 onward. Resolved without touching the deploy-key policy: PR #2643 (promoted in #2644 as 73bd48a) mints a per-run GitHub App token — genie-release-bot, app id 4393439, contents:write + metadata:read only, installed on this repository alone, sole ruleset bypass actor Integration:4393439:always. No user, role, or Actions bypass was added, and the token expires in ~1h so no long-lived credential can push to main. The dev/homolog criterion stays UNCHECKED until a post-merge dev release actually advances a channel manifest — this commit is that release's trigger.
|
Caution The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased. |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0ac0d5c7bc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - [ ] Production Environment approval requires an independent maintainer and is evidenced without exposing secrets. *(The live environment now admits only `main`, requires either `namastex888` or `vasconceloscezar`, prevents self-review, and forbids admin bypass; an end-to-end two-maintainer demonstration is still required.)* | ||
| - [x] Swap/promotion rollback and current artifact verification pass destructive-failure fixtures. *(7 fixtures; verify-release.sh realigned to real asset scheme)* | ||
| - [ ] Dev/homolog channel releases continue to publish without manual approval throughout and after this work. *(The main-controlled `version.yml` path remains reviewer-free, but manifest publication is intentionally blocked while the organization-wide deploy-key policy prevents provisioning the narrow `release-manifests` credential. Confirm live after separately approved credential setup and the first post-merge dev release.)* | ||
| - [ ] Dev/homolog channel releases continue to publish without manual approval throughout and after this work. *(The main-controlled `version.yml` path remains reviewer-free. **Credential setup is now complete (2026-07-25):** the org-wide deploy-key ban made the ssh model unusable, and the fine-grained PAT that replaced it still could not push because the `main` ruleset carried a `pull_request` rule with an empty `bypass_actors` list — every direct push was rejected `GH013` regardless of token scope. PR #2643 replaced both with a per-run GitHub App token (`genie-release-bot`, app id `4393439`, `contents:write` + `metadata:read` only, installed on this repository alone), promoted to `main` in #2644 as `73bd48af`. The App is the sole ruleset bypass actor (`Integration:4393439:always`); no user, role, or Actions bypass was added. Remains unchecked until the first post-merge dev release actually advances a channel manifest.)* |
There was a problem hiding this comment.
The reviewed commit declares the external credential and ruleset setup complete, but the only committed settings export, qa/github-settings-evidence-20260714.json, still records bypass_actors: [], no manifest-write secret, and disabled release workflows. Without a new redacted settings/API capture, auditors cannot verify the App installation scope, permissions, environment secret names, or sole-bypass assertion; add and reference dated evidence for the 2026-07-25 state.
Useful? React with 👍 / 👎.
| 3. Exported evidence (GitHub API JSON or settings export, no secrets) committed under `qa/` in this wish — must capture the reviewer set **and** the prevent-self-review setting explicitly. | ||
| 4. Deployment branch policy permits the protected `main` control ref used by `release.yml`; bot-authored automation cannot initiate stable, and a live two-maintainer run proves the initiating maintainer cannot approve it. | ||
| 5. The `release-manifests` environment remains reviewer-free and restricted to `main`; its write credential is provisioned only after separate approval to change the organization-wide deploy-key policy, without adding a broader Actions or user-token bypass. | ||
| 5. The `release-manifests` environment remains reviewer-free and restricted to `main`; its write credential is provisioned without adding a broader Actions or user-token bypass. **Resolved 2026-07-25 without touching the deploy-key policy:** the credential is a GitHub App (`genie-release-bot`, app id `4393439`) whose short-lived token is minted per run and expires in ~1h, so no long-lived credential can push to `main`. Its private key is held only as the `RELEASE_MANIFESTS_APP_ID`/`RELEASE_MANIFESTS_APP_PRIVATE_KEY` environment secrets, and the ruleset bypass names the App integration alone. |
There was a problem hiding this comment.
If RELEASE_MANIFESTS_APP_PRIVATE_KEY is exposed, the one-hour installation-token expiry does not bound the compromise because the stored private key can continuously mint replacement tokens until it is revoked. Calling this an absence of long-lived credentials understates the security and rotation risk, especially since this same sentence acknowledges that the private key persists as an environment secret; document the short-lived token separately from the long-lived App key.
Useful? React with 👍 / 👎.
Records that the
release-manifestscredential blocker is resolved, and triggers the dev release that proves it.What was wrong
The manifest push failed on every release since 2026-07-20, freezing the channel pointers (stable
5.260720.10, dev5.260723.8) whilev5.260724.1published 12 assets no channel could reach.Two credential models failed identically, and the workflow's diagnostic blamed token scope both times. The actual cause was the
mainruleset (9203218): apull_requestrule with an emptybypass_actorslist rejects every direct pushGH013no matter how it authenticates.What changed
PR #2643 (promoted in #2644 as
73bd48af) mints a per-run GitHub App token instead:genie-release-bot, app id4393439,contents:write+metadata:readonly, no webhooksautomagik-dev/geniealone (repository_selection: selected)Integration:4393439:always— no user, role, or Actions bypass was added, so no human gained push-to-mainmainWhy the criterion stays unchecked
The wish requires confirming "live after separately approved credential setup and the first post-merge dev release." Setup is done; the dev release is not. This commit is that release's trigger — merging it runs CI on
dev, which firesversion.yml→ dev release → the first manifest push under the App identity.If the dev manifest pointer advances past
5.260723.8, the criterion gets checked in a follow-up with the run as evidence. If it fails again, the failure lands here rather than in a claim.bun test scripts/wishes-lint.test.ts→ 11 pass / 0 fail.