From 87c66c0b8a7ccab2ec6f5f04512a9de55fe5ee96 Mon Sep 17 00:00:00 2001 From: "Founders' are 'found' to implement." Date: Wed, 23 Sep 2026 01:32:34 -0700 Subject: [PATCH 1/3] ops(codespace): use ARCHWIZ/OPERATOR secret chain (monorepo SSOT) Match deepseek-ci / help-wanted precedence. CODESPACE_CREATE_TOKEN optional override only. Never print token values. Agent-Identity: Grok (Administrator) --- .github/workflows/codespace-create.yml | 54 +++++++++++++++++--------- 1 file changed, 35 insertions(+), 19 deletions(-) diff --git a/.github/workflows/codespace-create.yml b/.github/workflows/codespace-create.yml index 5bd300edb..a56910783 100644 --- a/.github/workflows/codespace-create.yml +++ b/.github/workflows/codespace-create.yml @@ -1,9 +1,10 @@ name: Codespace create (dispatch) -# Creates a Codespace on a ref using a PAT with `codespace` scope. -# Credential plane: issue #184 (names/scopes). Value lives only in -# Settings → Secrets → Actions as CODESPACE_CREATE_TOKEN. -# Never commit or print the token. +# Creates a Codespace via API using the monorepo privileged GH token chain. +# SSOT precedence (same as deepseek-ci / help-wanted / dependency-phase): +# ARCHWIZ_GITHUB_TOKEN || OPERATOR_GITHUB_TOKEN || OPERATOR_TOKEN +# Optional override: CODESPACE_CREATE_TOKEN (if set, wins) +# Values live only in Settings → Secrets → Actions. Never print. on: workflow_dispatch: @@ -29,22 +30,35 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 10 steps: - - name: Require secret + - name: Resolve token presence (names only) + id: tok env: - HAS_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN != '' }} + HAS_CS: ${{ secrets.CODESPACE_CREATE_TOKEN != '' }} + HAS_ARCHWIZ: ${{ secrets.ARCHWIZ_GITHUB_TOKEN != '' }} + HAS_OP_GH: ${{ secrets.OPERATOR_GITHUB_TOKEN != '' }} + HAS_OP: ${{ secrets.OPERATOR_TOKEN != '' }} run: | - if [ "$HAS_TOKEN" != "true" ]; then - echo "::error::CODESPACE_CREATE_TOKEN secret is empty." - echo "Add a classic or fine-grained PAT with codespace scope" - echo "(see issue #184 inventory) under Settings → Secrets → Actions." - echo "Do not paste the value into issues, PR bodies, or chat." + set -euo pipefail + # Report which secret NAMES are non-empty — never values + echo "CODESPACE_CREATE_TOKEN present: $HAS_CS" + echo "ARCHWIZ_GITHUB_TOKEN present: $HAS_ARCHWIZ" + echo "OPERATOR_GITHUB_TOKEN present: $HAS_OP_GH" + echo "OPERATOR_TOKEN present: $HAS_OP" + if [ "$HAS_CS" = "true" ] || [ "$HAS_ARCHWIZ" = "true" ] || [ "$HAS_OP_GH" = "true" ] || [ "$HAS_OP" = "true" ]; then + echo "resolved=true" >> "$GITHUB_OUTPUT" + else + echo "resolved=false" >> "$GITHUB_OUTPUT" + echo "::error::No privileged GH token secret present." + echo "Expected one of: CODESPACE_CREATE_TOKEN, ARCHWIZ_GITHUB_TOKEN," + echo "OPERATOR_GITHUB_TOKEN, OPERATOR_TOKEN (repo Actions secrets)." exit 1 fi - name: Create codespace id: create env: - GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN }} + # Precedence matches monorepo SSOT; override first if set + GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN || secrets.ARCHWIZ_GITHUB_TOKEN || secrets.OPERATOR_GITHUB_TOKEN || secrets.OPERATOR_TOKEN }} REF: ${{ inputs.ref }} MACHINE: ${{ inputs.machine }} DISPLAY: ${{ inputs.display_name }} @@ -61,24 +75,26 @@ jobs: -H "X-GitHub-Api-Version: 2022-11-28" \ "https://api.github.com/repos/timerloggedout-spec/termux-monorepo/codespaces" \ -d "$body") - echo "$resp" | jq '{name, id, state, machine: .machine.name, web_url, created_at}' || echo "$resp" + echo "$resp" | jq '{name, id, state, machine: .machine.name, web_url, created_at, message, documentation_url}' 2>/dev/null || echo "$resp" name=$(echo "$resp" | jq -r '.name // empty') web=$(echo "$resp" | jq -r '.web_url // empty') if [ -z "$name" ]; then - echo "::error::Codespace create failed — check PAT scopes (codespace) and billing." + echo "::error::Codespace create failed — token may lack codespace scope, or billing/limit." echo "$resp" | jq . 2>/dev/null || echo "$resp" exit 1 fi echo "name=$name" >> "$GITHUB_OUTPUT" echo "web_url=$web" >> "$GITHUB_OUTPUT" - echo "### Codespace created" >> "$GITHUB_STEP_SUMMARY" - echo "- **name:** \`$name\`" >> "$GITHUB_STEP_SUMMARY" - echo "- **url:** $web" >> "$GITHUB_STEP_SUMMARY" - echo "- **ref:** \`$REF\`" >> "$GITHUB_STEP_SUMMARY" + { + echo "### Codespace created" + echo "- **name:** \`$name\`" + echo "- **url:** $web" + echo "- **ref:** \`$REF\`" + } >> "$GITHUB_STEP_SUMMARY" - name: List codespaces (evidence) env: - GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN }} + GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN || secrets.ARCHWIZ_GITHUB_TOKEN || secrets.OPERATOR_GITHUB_TOKEN || secrets.OPERATOR_TOKEN }} run: | curl -sS \ -H "Accept: application/vnd.github+json" \ From 439a9086041d45ec9fefc647c41544d450e98ea6 Mon Sep 17 00:00:00 2001 From: "Founders' are 'found' to implement." Date: Wed, 23 Sep 2026 01:34:08 -0700 Subject: [PATCH 2/3] fix(codespace): machine is string not object (API 422) Evidence run 35837732442: ARCHWIZ+OPERATOR present; body shape wrong. Agent-Identity: Grok (Administrator) --- .github/workflows/codespace-create.yml | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/.github/workflows/codespace-create.yml b/.github/workflows/codespace-create.yml index a56910783..3dbdb0543 100644 --- a/.github/workflows/codespace-create.yml +++ b/.github/workflows/codespace-create.yml @@ -1,10 +1,9 @@ name: Codespace create (dispatch) # Creates a Codespace via API using the monorepo privileged GH token chain. -# SSOT precedence (same as deepseek-ci / help-wanted / dependency-phase): -# ARCHWIZ_GITHUB_TOKEN || OPERATOR_GITHUB_TOKEN || OPERATOR_TOKEN -# Optional override: CODESPACE_CREATE_TOKEN (if set, wins) -# Values live only in Settings → Secrets → Actions. Never print. +# SSOT: ARCHWIZ_GITHUB_TOKEN || OPERATOR_GITHUB_TOKEN || OPERATOR_TOKEN +# Optional override: CODESPACE_CREATE_TOKEN +# Never print token values. on: workflow_dispatch: @@ -39,7 +38,6 @@ jobs: HAS_OP: ${{ secrets.OPERATOR_TOKEN != '' }} run: | set -euo pipefail - # Report which secret NAMES are non-empty — never values echo "CODESPACE_CREATE_TOKEN present: $HAS_CS" echo "ARCHWIZ_GITHUB_TOKEN present: $HAS_ARCHWIZ" echo "OPERATOR_GITHUB_TOKEN present: $HAS_OP_GH" @@ -47,28 +45,26 @@ jobs: if [ "$HAS_CS" = "true" ] || [ "$HAS_ARCHWIZ" = "true" ] || [ "$HAS_OP_GH" = "true" ] || [ "$HAS_OP" = "true" ]; then echo "resolved=true" >> "$GITHUB_OUTPUT" else - echo "resolved=false" >> "$GITHUB_OUTPUT" echo "::error::No privileged GH token secret present." - echo "Expected one of: CODESPACE_CREATE_TOKEN, ARCHWIZ_GITHUB_TOKEN," - echo "OPERATOR_GITHUB_TOKEN, OPERATOR_TOKEN (repo Actions secrets)." exit 1 fi - name: Create codespace id: create env: - # Precedence matches monorepo SSOT; override first if set GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN || secrets.ARCHWIZ_GITHUB_TOKEN || secrets.OPERATOR_GITHUB_TOKEN || secrets.OPERATOR_TOKEN }} REF: ${{ inputs.ref }} MACHINE: ${{ inputs.machine }} DISPLAY: ${{ inputs.display_name }} run: | set -euo pipefail + # GitHub API: machine is a STRING, not {name: ...} body=$(jq -n \ --arg ref "$REF" \ --arg machine "$MACHINE" \ --arg name "$DISPLAY" \ - '{ref: $ref, machine: {name: $machine}, display_name: $name}') + '{ref: $ref, machine: $machine, display_name: $name}') + echo "request body (no secrets): $body" resp=$(curl -sS -X POST \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer ${GH_TOKEN}" \ @@ -79,7 +75,7 @@ jobs: name=$(echo "$resp" | jq -r '.name // empty') web=$(echo "$resp" | jq -r '.web_url // empty') if [ -z "$name" ]; then - echo "::error::Codespace create failed — token may lack codespace scope, or billing/limit." + echo "::error::Codespace create failed" echo "$resp" | jq . 2>/dev/null || echo "$resp" exit 1 fi From 8384bcc9e41eba9e6fad604fd0b85ab95626fd4c Mon Sep 17 00:00:00 2001 From: "Founders' are 'found' to implement." Date: Wed, 23 Sep 2026 01:34:44 -0700 Subject: [PATCH 3/3] =?UTF-8?q?fix(codespace):=20omit=20machine=20?= =?UTF-8?q?=E2=86=92=20use=20repo=20default=20(basicLinux32gb=20not=20allo?= =?UTF-8?q?wed)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Evidence 35837866314: token OK; machine type rejected. Agent-Identity: Grok (Administrator) --- .github/workflows/codespace-create.yml | 43 +++++++++++++------------- 1 file changed, 21 insertions(+), 22 deletions(-) diff --git a/.github/workflows/codespace-create.yml b/.github/workflows/codespace-create.yml index 3dbdb0543..26540c6e4 100644 --- a/.github/workflows/codespace-create.yml +++ b/.github/workflows/codespace-create.yml @@ -1,9 +1,8 @@ name: Codespace create (dispatch) -# Creates a Codespace via API using the monorepo privileged GH token chain. +# Creates a Codespace via API using monorepo privileged GH token chain. # SSOT: ARCHWIZ_GITHUB_TOKEN || OPERATOR_GITHUB_TOKEN || OPERATOR_TOKEN -# Optional override: CODESPACE_CREATE_TOKEN -# Never print token values. +# Optional: CODESPACE_CREATE_TOKEN. Never print values. on: workflow_dispatch: @@ -12,10 +11,6 @@ on: description: Branch or SHA (default master) required: false default: master - machine: - description: Machine type (basicLinux32gb | standardLinux32gb | premiumLinux) - required: false - default: basicLinux32gb display_name: description: Optional display name required: false @@ -27,10 +22,9 @@ permissions: jobs: create: runs-on: ubuntu-latest - timeout-minutes: 10 + timeout-minutes: 15 steps: - name: Resolve token presence (names only) - id: tok env: HAS_CS: ${{ secrets.CODESPACE_CREATE_TOKEN != '' }} HAS_ARCHWIZ: ${{ secrets.ARCHWIZ_GITHUB_TOKEN != '' }} @@ -42,36 +36,41 @@ jobs: echo "ARCHWIZ_GITHUB_TOKEN present: $HAS_ARCHWIZ" echo "OPERATOR_GITHUB_TOKEN present: $HAS_OP_GH" echo "OPERATOR_TOKEN present: $HAS_OP" - if [ "$HAS_CS" = "true" ] || [ "$HAS_ARCHWIZ" = "true" ] || [ "$HAS_OP_GH" = "true" ] || [ "$HAS_OP" = "true" ]; then - echo "resolved=true" >> "$GITHUB_OUTPUT" - else + if [ "$HAS_CS" != "true" ] && [ "$HAS_ARCHWIZ" != "true" ] && [ "$HAS_OP_GH" != "true" ] && [ "$HAS_OP" != "true" ]; then echo "::error::No privileged GH token secret present." exit 1 fi - - name: Create codespace + - name: List allowed machines + env: + GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN || secrets.ARCHWIZ_GITHUB_TOKEN || secrets.OPERATOR_GITHUB_TOKEN || secrets.OPERATOR_TOKEN }} + run: | + curl -sS \ + -H "Accept: application/vnd.github+json" \ + -H "Authorization: Bearer ${GH_TOKEN}" \ + -H "X-GitHub-Api-Version: 2022-11-28" \ + "https://api.github.com/repos/timerloggedout-spec/termux-monorepo/codespaces/machines?ref=master" \ + | jq '{machines: [.machines[]? | {name, display_name, prebuild_availability}]}' \ + || true + + - name: Create codespace (default machine) id: create env: GH_TOKEN: ${{ secrets.CODESPACE_CREATE_TOKEN || secrets.ARCHWIZ_GITHUB_TOKEN || secrets.OPERATOR_GITHUB_TOKEN || secrets.OPERATOR_TOKEN }} REF: ${{ inputs.ref }} - MACHINE: ${{ inputs.machine }} DISPLAY: ${{ inputs.display_name }} run: | set -euo pipefail - # GitHub API: machine is a STRING, not {name: ...} - body=$(jq -n \ - --arg ref "$REF" \ - --arg machine "$MACHINE" \ - --arg name "$DISPLAY" \ - '{ref: $ref, machine: $machine, display_name: $name}') - echo "request body (no secrets): $body" + # Omit machine → API picks repo default / first allowed + body=$(jq -n --arg ref "$REF" --arg name "$DISPLAY" '{ref: $ref, display_name: $name}') + echo "request body: $body" resp=$(curl -sS -X POST \ -H "Accept: application/vnd.github+json" \ -H "Authorization: Bearer ${GH_TOKEN}" \ -H "X-GitHub-Api-Version: 2022-11-28" \ "https://api.github.com/repos/timerloggedout-spec/termux-monorepo/codespaces" \ -d "$body") - echo "$resp" | jq '{name, id, state, machine: .machine.name, web_url, created_at, message, documentation_url}' 2>/dev/null || echo "$resp" + echo "$resp" | jq '{name, id, state, machine: .machine.name, web_url, created_at, message}' 2>/dev/null || echo "$resp" name=$(echo "$resp" | jq -r '.name // empty') web=$(echo "$resp" | jq -r '.web_url // empty') if [ -z "$name" ]; then