Skip to content

ci: update release app secret references #237

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mynameistito wants to merge 9 commits into
base: main
Choose a base branch
from
Open

ci: update release app secret references #237

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
0aef17c
ci: update release app secret references
mynameistito Nov 6, 2026
3b8823e
ci: use scoped release vault account
mynameistito Nov 6, 2026
9d2a4b8
ci: add isolated target vault preflight
mynameistito Nov 6, 2026
d691fc3
ci: remove temporary vault preflight
mynameistito Nov 6, 2026
7ffa06a
ci: use canonical release app references
mynameistito Nov 6, 2026
039eea9
ci: validate canonical release vault access
mynameistito Nov 6, 2026
9eac4c8
ci: scope release workflow permissions
mynameistito Nov 6, 2026
64a69c4
ci: retain scoped npm publishing exception
mynameistito Nov 6, 2026
3302535
ci: preserve trusted security configuration alignment
mynameistito Nov 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 32 additions & 9 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json

on:
push:
branches:
Expand All @@ -8,13 +6,15 @@ on:
name: Release
concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
contents: write
id-token: write
pull-requests: write
permissions: {}

jobs:
release:
if: github.event_name != 'workflow_dispatch' || github.ref != 'refs/heads/chore/modernisation-20261106'
permissions:
contents: write
id-token: write
pull-requests: write
runs-on: ubuntu-24.04
steps:
- name: Checkout
Expand Down Expand Up @@ -57,9 +57,9 @@ jobs:
with:
version: 2.39.0
env:
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
GH_APP_ID: op://uhub4xx3iwwsaxj3robdosm2hu/spbjca2lethbsiz6menimq7afm/ID
GH_APP_PRIVATE_KEY: op://uhub4xx3iwwsaxj3robdosm2hu/spbjca2lethbsiz6menimq7afm/github-app.pem
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_TARGET_SERVICE_ACCOUNT_TOKEN }}
GH_APP_ID: op://i56qshgciuy4cdg4pjrilaeriy/7aa4yniajfri3k6tafs5z63sje/github_app_id
GH_APP_PRIVATE_KEY: op://i56qshgciuy4cdg4pjrilaeriy/7aa4yniajfri3k6tafs5z63sje/github_app_private_key
- name: Create repository-scoped App token
id: app-token
uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
Expand All @@ -81,3 +81,26 @@ jobs:
commit-message: "chore: release packages"
env:
GIT_EXECUTABLE: /usr/bin/git

validate_target_vault:

@cubic-dev-ai cubic-dev-ai Bot Nov 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: The validate_target_vault job and the branch-pinned if on release are temporary scaffolding for this branch's manual check, but they ship in the permanent release workflow. Once the branch is merged and deleted, the job is effectively unreachable and the release guard is always true. Remove the validation job and the guard before merging, or run this check outside the repository.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. At .github/workflows/release.yml, line 85:

<comment>The `validate_target_vault` job and the branch-pinned `if` on `release` are temporary scaffolding for this branch's manual check, but they ship in the permanent release workflow. Once the branch is merged and deleted, the job is effectively unreachable and the release guard is always true. Remove the validation job and the guard before merging, or run this check outside the repository.</comment>

<file context>
@@ -81,3 +81,26 @@ jobs:
         env:
           GIT_EXECUTABLE: /usr/bin/git
+
+  validate_target_vault:
+    if: >-
+      github.event_name == 'workflow_dispatch' && github.repository == 'mynameistito/opencode-plugins' && github.ref == 'refs/heads/chore/modernisation-20261106'
</file context>

@mynameistito mynameistito Nov 6, 2026

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note

🤖 GPT-6.1 Terra responding on behalf of mynameistito

Confirmed: this is branch-specific preflight scaffolding. It keeps the release job skipped during the explicitly requested exact-head validation-only dispatch. It should be removed before any eventual merge, with the resulting head revalidated through an independently safe mechanism; this PR is not authorized to merge. Keeping the guard now avoids accidentally running release operations during a dispatch.

if: >-
github.event_name == 'workflow_dispatch' && github.repository == 'mynameistito/opencode-plugins' && github.ref == 'refs/heads/chore/modernisation-20261106'
permissions: {}
runs-on: ubuntu-24.04
steps:
- name: Load canonical references
id: onepassword
uses: 1Password/load-secrets-action@70062d7a876d3eb6334754fa26efd2fbd90c32f2 # v5.0.1
with:
version: 2.39.0
env:
OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_TARGET_SERVICE_ACCOUNT_TOKEN }}
GH_APP_ID: op://i56qshgciuy4cdg4pjrilaeriy/7aa4yniajfri3k6tafs5z63sje/github_app_id
GH_APP_PRIVATE_KEY: op://i56qshgciuy4cdg4pjrilaeriy/7aa4yniajfri3k6tafs5z63sje/github_app_private_key
- name: Check canonical references are available
env:
GH_APP_ID: ${{ steps.onepassword.outputs.GH_APP_ID }}
GH_APP_PRIVATE_KEY: ${{ steps.onepassword.outputs.GH_APP_PRIVATE_KEY }}
run: |
test -n "$GH_APP_ID"
test -n "$GH_APP_PRIVATE_KEY"
Comment thread
mynameistito marked this conversation as resolved.
Resolved