From 0aef17c8d9ce77bfd417e4b2776dd8e9b784e684 Mon Sep 17 00:00:00 2001 From: My Name is Tito Date: Fri, 6 Nov 2026 20:26:22 +1300 Subject: [PATCH 1/9] ci: update release app secret references --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 17ecfd9..b913aa5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -58,8 +58,8 @@ jobs: version: 2.39.0 env: OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} - GH_APP_ID: op://uhub4xx3iwwsaxj3robdosm2hu/spbjca2lethbsiz6menimq7afm/ID - GH_APP_PRIVATE_KEY: op://uhub4xx3iwwsaxj3robdosm2hu/spbjca2lethbsiz6menimq7afm/github-app.pem + GH_APP_ID: op://i56qshgciuy4cdg4pjrilaeriy/42szi44u2t6lu4d5jnr3a2hbae/fbthjszlbqsoyfn4itfgesd3dy + GH_APP_PRIVATE_KEY: op://i56qshgciuy4cdg4pjrilaeriy/42szi44u2t6lu4d5jnr3a2hbae/github-app.pem - name: Create repository-scoped App token id: app-token uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 From 3b8823ef5a085d15c70de917597c866c34ec23bb Mon Sep 17 00:00:00 2001 From: My Name is Tito Date: Fri, 6 Nov 2026 21:04:19 +1300 Subject: [PATCH 2/9] ci: use scoped release vault account --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index b913aa5..99b64cc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -57,7 +57,7 @@ jobs: with: version: 2.39.0 env: - OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }} + OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_TARGET_SERVICE_ACCOUNT_TOKEN }} GH_APP_ID: op://i56qshgciuy4cdg4pjrilaeriy/42szi44u2t6lu4d5jnr3a2hbae/fbthjszlbqsoyfn4itfgesd3dy GH_APP_PRIVATE_KEY: op://i56qshgciuy4cdg4pjrilaeriy/42szi44u2t6lu4d5jnr3a2hbae/github-app.pem - name: Create repository-scoped App token From 9d2a4b8b8c90cf7958404403f25808cf96fad75b Mon Sep 17 00:00:00 2001 From: My Name is Tito Date: Fri, 6 Nov 2026 21:06:00 +1300 Subject: [PATCH 3/9] ci: add isolated target vault preflight --- .github/workflows/release.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 99b64cc..9bc2079 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,7 @@ permissions: jobs: release: + if: github.event_name != 'workflow_dispatch' || github.ref != 'refs/heads/chore/modernisation-20261106' runs-on: ubuntu-24.04 steps: - name: Checkout @@ -81,3 +82,28 @@ jobs: commit-message: "chore: release packages" env: GIT_EXECUTABLE: /usr/bin/git + + validate_target_vault: + if: >- + github.event_name == 'workflow_dispatch' && + github.repository == 'mynameistito/opencode-plugins' && + github.ref == 'refs/heads/chore/modernisation-20261106' + permissions: {} + runs-on: ubuntu-24.04 + steps: + - name: Load target references + id: onepassword + uses: 1Password/load-secrets-action@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 + with: + version: 2.39.0 + env: + OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_TARGET_SERVICE_ACCOUNT_TOKEN }} + GH_APP_ID: op://i56qshgciuy4cdg4pjrilaeriy/42szi44u2t6lu4d5jnr3a2hbae/fbthjszlbqsoyfn4itfgesd3dy + GH_APP_PRIVATE_KEY: op://i56qshgciuy4cdg4pjrilaeriy/42szi44u2t6lu4d5jnr3a2hbae/github-app.pem + - name: Check target references are available + env: + GH_APP_ID: ${{ steps.onepassword.outputs.GH_APP_ID }} + GH_APP_PRIVATE_KEY: ${{ steps.onepassword.outputs.GH_APP_PRIVATE_KEY }} + run: | + test -n "$GH_APP_ID" + test -n "$GH_APP_PRIVATE_KEY" From d691fc3e3a02046e563b74c2eebf1e533ac615a0 Mon Sep 17 00:00:00 2001 From: My Name is Tito Date: Fri, 6 Nov 2026 21:07:37 +1300 Subject: [PATCH 4/9] ci: remove temporary vault preflight --- .github/workflows/release.yml | 26 -------------------------- 1 file changed, 26 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 9bc2079..99b64cc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,7 +15,6 @@ permissions: jobs: release: - if: github.event_name != 'workflow_dispatch' || github.ref != 'refs/heads/chore/modernisation-20261106' runs-on: ubuntu-24.04 steps: - name: Checkout @@ -82,28 +81,3 @@ jobs: commit-message: "chore: release packages" env: GIT_EXECUTABLE: /usr/bin/git - - validate_target_vault: - if: >- - github.event_name == 'workflow_dispatch' && - github.repository == 'mynameistito/opencode-plugins' && - github.ref == 'refs/heads/chore/modernisation-20261106' - permissions: {} - runs-on: ubuntu-24.04 - steps: - - name: Load target references - id: onepassword - uses: 1Password/load-secrets-action@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 - with: - version: 2.39.0 - env: - OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_TARGET_SERVICE_ACCOUNT_TOKEN }} - GH_APP_ID: op://i56qshgciuy4cdg4pjrilaeriy/42szi44u2t6lu4d5jnr3a2hbae/fbthjszlbqsoyfn4itfgesd3dy - GH_APP_PRIVATE_KEY: op://i56qshgciuy4cdg4pjrilaeriy/42szi44u2t6lu4d5jnr3a2hbae/github-app.pem - - name: Check target references are available - env: - GH_APP_ID: ${{ steps.onepassword.outputs.GH_APP_ID }} - GH_APP_PRIVATE_KEY: ${{ steps.onepassword.outputs.GH_APP_PRIVATE_KEY }} - run: | - test -n "$GH_APP_ID" - test -n "$GH_APP_PRIVATE_KEY" From 7ffa06a0a919099432c4fb424f02961d401dda12 Mon Sep 17 00:00:00 2001 From: My Name is Tito Date: Fri, 6 Nov 2026 21:09:25 +1300 Subject: [PATCH 5/9] ci: use canonical release app references --- .github/workflows/release.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 99b64cc..3fa814c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -58,8 +58,8 @@ jobs: version: 2.39.0 env: OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_TARGET_SERVICE_ACCOUNT_TOKEN }} - GH_APP_ID: op://i56qshgciuy4cdg4pjrilaeriy/42szi44u2t6lu4d5jnr3a2hbae/fbthjszlbqsoyfn4itfgesd3dy - GH_APP_PRIVATE_KEY: op://i56qshgciuy4cdg4pjrilaeriy/42szi44u2t6lu4d5jnr3a2hbae/github-app.pem + GH_APP_ID: op://i56qshgciuy4cdg4pjrilaeriy/7aa4yniajfri3k6tafs5z63sje/github_app_id + GH_APP_PRIVATE_KEY: op://i56qshgciuy4cdg4pjrilaeriy/7aa4yniajfri3k6tafs5z63sje/github_app_private_key - name: Create repository-scoped App token id: app-token uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0 From 039eea9a781303157875dd3a32e9a54407c1a608 Mon Sep 17 00:00:00 2001 From: My Name is Tito Date: Fri, 6 Nov 2026 21:10:13 +1300 Subject: [PATCH 6/9] ci: validate canonical release vault access --- .github/workflows/release.yml | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3fa814c..4d6504f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -15,6 +15,7 @@ permissions: jobs: release: + if: github.event_name != 'workflow_dispatch' || github.ref != 'refs/heads/chore/modernisation-20261106' runs-on: ubuntu-24.04 steps: - name: Checkout @@ -81,3 +82,28 @@ jobs: commit-message: "chore: release packages" env: GIT_EXECUTABLE: /usr/bin/git + + validate_target_vault: + if: >- + github.event_name == 'workflow_dispatch' && + github.repository == 'mynameistito/opencode-plugins' && + github.ref == 'refs/heads/chore/modernisation-20261106' + permissions: {} + runs-on: ubuntu-24.04 + steps: + - name: Load canonical references + id: onepassword + uses: 1Password/load-secrets-action@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1 + with: + version: 2.39.0 + env: + OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_TARGET_SERVICE_ACCOUNT_TOKEN }} + GH_APP_ID: op://i56qshgciuy4cdg4pjrilaeriy/7aa4yniajfri3k6tafs5z63sje/github_app_id + GH_APP_PRIVATE_KEY: op://i56qshgciuy4cdg4pjrilaeriy/7aa4yniajfri3k6tafs5z63sje/github_app_private_key + - name: Check canonical references are available + env: + GH_APP_ID: ${{ steps.onepassword.outputs.GH_APP_ID }} + GH_APP_PRIVATE_KEY: ${{ steps.onepassword.outputs.GH_APP_PRIVATE_KEY }} + run: | + test -n "$GH_APP_ID" + test -n "$GH_APP_PRIVATE_KEY" From 9eac4c84693d2a5eb093b945fdbb3ee63ec6ea93 Mon Sep 17 00:00:00 2001 From: My Name is Tito Date: Fri, 6 Nov 2026 21:15:24 +1300 Subject: [PATCH 7/9] ci: scope release workflow permissions --- .github/workflows/release.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4d6504f..366cedc 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -8,14 +8,15 @@ on: name: Release concurrency: ${{ github.workflow }}-${{ github.ref }} -permissions: - contents: write - id-token: write - pull-requests: write +permissions: {} jobs: release: if: github.event_name != 'workflow_dispatch' || github.ref != 'refs/heads/chore/modernisation-20261106' + permissions: + contents: write + id-token: write + pull-requests: write runs-on: ubuntu-24.04 steps: - name: Checkout @@ -85,9 +86,7 @@ jobs: validate_target_vault: if: >- - github.event_name == 'workflow_dispatch' && - github.repository == 'mynameistito/opencode-plugins' && - github.ref == 'refs/heads/chore/modernisation-20261106' + github.event_name == 'workflow_dispatch' && github.repository == 'mynameistito/opencode-plugins' && github.ref == 'refs/heads/chore/modernisation-20261106' permissions: {} runs-on: ubuntu-24.04 steps: From 64a69c486a9522b0fe698ffb96d6f442be3ec545 Mon Sep 17 00:00:00 2001 From: My Name is Tito Date: Fri, 6 Nov 2026 21:22:08 +1300 Subject: [PATCH 8/9] ci: retain scoped npm publishing exception --- .github/zizmor.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 1349a2a..e4c2690 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -15,4 +15,5 @@ rules: - deploy-preview.yml:21 adhoc-packages: ignore: - - release.yml:35 + # Existing pinned npm upgrade is required for staged publishing. + - release.yml:37 From 33025351f0de1abe9410e2155fc3ad6c28418b4f Mon Sep 17 00:00:00 2001 From: My Name is Tito Date: Fri, 6 Nov 2026 21:24:17 +1300 Subject: [PATCH 9/9] ci: preserve trusted security configuration alignment --- .github/workflows/release.yml | 2 -- .github/zizmor.yml | 3 +-- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 366cedc..15d8527 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,5 +1,3 @@ -# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json - on: push: branches: diff --git a/.github/zizmor.yml b/.github/zizmor.yml index e4c2690..1349a2a 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -15,5 +15,4 @@ rules: - deploy-preview.yml:21 adhoc-packages: ignore: - # Existing pinned npm upgrade is required for staged publishing. - - release.yml:37 + - release.yml:35