Skip to content

docs(wish): record release-manifest credential resolution (stable gate) #2645

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
namastex888 merged 1 commit into from
Jul 25, 2026
Merged

docs(wish): record release-manifest credential resolution (stable gate) #2645

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions .genie/wishes/stable-release-security-gate/WISH.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ Close inherited stable-publication risks that are unchanged by PR #2545 but stil
- [x] External Actions are SHA-pinned; installs are frozen; permissions and secrets are least-privilege. *(All remote dependencies are commit-pinned except the SLSA generator's mandatory exact `v2.1.0` builder-identity reference; that exception is explicit and regression-tested.)*
- [ ] Production Environment approval requires an independent maintainer and is evidenced without exposing secrets. *(The live environment now admits only `main`, requires either `namastex888` or `vasconceloscezar`, prevents self-review, and forbids admin bypass; an end-to-end two-maintainer demonstration is still required.)*
- [x] Swap/promotion rollback and current artifact verification pass destructive-failure fixtures. *(7 fixtures; verify-release.sh realigned to real asset scheme)*
- [ ] Dev/homolog channel releases continue to publish without manual approval throughout and after this work. *(The main-controlled `version.yml` path remains reviewer-free, but manifest publication is intentionally blocked while the organization-wide deploy-key policy prevents provisioning the narrow `release-manifests` credential. Confirm live after separately approved credential setup and the first post-merge dev release.)*
- [ ] Dev/homolog channel releases continue to publish without manual approval throughout and after this work. *(The main-controlled `version.yml` path remains reviewer-free. **Credential setup is now complete (2026-07-25):** the org-wide deploy-key ban made the ssh model unusable, and the fine-grained PAT that replaced it still could not push because the `main` ruleset carried a `pull_request` rule with an empty `bypass_actors` list — every direct push was rejected `GH013` regardless of token scope. PR #2643 replaced both with a per-run GitHub App token (`genie-release-bot`, app id `4393439`, `contents:write` + `metadata:read` only, installed on this repository alone), promoted to `main` in #2644 as `73bd48af`. The App is the sole ruleset bypass actor (`Integration:4393439:always`); no user, role, or Actions bypass was added. Remains unchecked until the first post-merge dev release actually advances a channel manifest.)*

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Add evidence for the completed credential setup

The reviewed commit declares the external credential and ruleset setup complete, but the only committed settings export, qa/github-settings-evidence-20260714.json, still records bypass_actors: [], no manifest-write secret, and disabled release workflows. Without a new redacted settings/API capture, auditors cannot verify the App installation scope, permissions, environment secret names, or sole-bypass assertion; add and reference dated evidence for the 2026-07-25 state.

Useful? React with 👍 / 👎.


## Execution Strategy

Expand Down Expand Up @@ -101,7 +101,7 @@ bun test
2. Ruleset/branch-tag protection for `v*` stable tags.
3. Exported evidence (GitHub API JSON or settings export, no secrets) committed under `qa/` in this wish — must capture the reviewer set **and** the prevent-self-review setting explicitly.
4. Deployment branch policy permits the protected `main` control ref used by `release.yml`; bot-authored automation cannot initiate stable, and a live two-maintainer run proves the initiating maintainer cannot approve it.
5. The `release-manifests` environment remains reviewer-free and restricted to `main`; its write credential is provisioned only after separate approval to change the organization-wide deploy-key policy, without adding a broader Actions or user-token bypass.
5. The `release-manifests` environment remains reviewer-free and restricted to `main`; its write credential is provisioned without adding a broader Actions or user-token bypass. **Resolved 2026-07-25 without touching the deploy-key policy:** the credential is a GitHub App (`genie-release-bot`, app id `4393439`) whose short-lived token is minted per run and expires in ~1h, so no long-lived credential can push to `main`. Its private key is held only as the `RELEASE_MANIFESTS_APP_ID`/`RELEASE_MANIFESTS_APP_PRIVATE_KEY` environment secrets, and the ruleset bypass names the App integration alone.

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 25, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Treat the App private key as long-lived authority

If RELEASE_MANIFESTS_APP_PRIVATE_KEY is exposed, the one-hour installation-token expiry does not bound the compromise because the stored private key can continuously mint replacement tokens until it is revoked. Calling this an absence of long-lived credentials understates the security and rotation risk, especially since this same sentence acknowledges that the private key persists as an environment secret; document the short-lived token separately from the long-lived App key.

Useful? React with 👍 / 👎.


**Acceptance Criteria:**
- [ ] Environment approval demonstrably requires an independent maintainer: current evidence shows reviewers `namastex888` + `vasconceloscezar`, `prevent_self_review: true`, `can_admins_bypass: false`, and an exact `main` deployment policy; no live two-maintainer run has yet been captured.
Expand Down