open-platform/app-template
Template
3
0
Fork 0
Code Issues Pull requests Releases 5 Packages 2 Wiki Activity Actions

SEC-2: attribute human actor into secrets-sync audit trail (plat/mitosis#44) #2

Merged
plat merged 1 commit from feat/sec-2-sync-env-actor into main 2026-07-01 03:21:45 +00:00
Conversation 0 Commits 1 Files changed 1 +9
plat commented 2026-07-01 02:15:31 +00:00
Owner
Copy link

Implements roadmap SEC-2 (#44) — app-template side.

The sync-env workflow now passes the human actor and the Forgejo Actions run into the secrets-cli so the platform's gitops sync commit attributes the human who set the secret instead of CI/plat-bot.

Change: in the sync step, add PLAT_ACTOR: ${{ github.actor }}, PLAT_RUN_URL (server_url/repository/actions/runs/run_id), and PLAT_SHA: ${{ github.sha }}, and forward them into the docker run (the container runs on the host daemon and does not inherit the runner's GITHUB_* env).

Pairs with the plat/mcp SEC-2 change that reads these and writes the commit trailer.

Validation: workflow YAML parses (PyYAML safe_load OK).

roadmap SEC-2 (#44)

Implements roadmap **SEC-2 (#44)** — app-template side. The `sync-env` workflow now passes the human actor and the Forgejo Actions run into the secrets-cli so the platform's gitops sync commit attributes the human who set the secret instead of CI/plat-bot. **Change:** in the sync step, add `PLAT_ACTOR: ${{ github.actor }}`, `PLAT_RUN_URL` (server_url/repository/actions/runs/run_id), and `PLAT_SHA: ${{ github.sha }}`, and forward them into the `docker run` (the container runs on the host daemon and does not inherit the runner's `GITHUB_*` env). Pairs with the `plat/mcp` SEC-2 change that reads these and writes the commit trailer. **Validation:** workflow YAML parses (PyYAML safe_load OK). roadmap SEC-2 (#44)
SEC-2: attribute human actor into secrets-sync audit trail (plat/mitosis#44)
Some checks failed
check / check (push) Successful in 1m38s
Details
check / check (pull_request) Successful in 1m33s
Details
preview / preview (pull_request) Failing after 18s
Details
9972679dbc 
Pass github.actor, the run URL, and the workflow SHA into the secrets-cli
invocation (as PLAT_ACTOR / PLAT_RUN_URL / PLAT_SHA, forwarded into the
container) so the platform's gitops sync commit names the human who set the
secret instead of CI. Pairs with the plat/mcp SEC-2 change.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
plat merged commit df21ff09a7 into main 2026-07-01 03:21:45 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-work
Queue this for an agent: it will build it and open a PR

  
agent-working
An agent is actively working on this

  
ultracode
Operators: run a Fable ultracode orchestrator on this issue

No labels
agent-work
agent-working
ultracode
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
open-platform/app-template!2
No description provided.