scoped-token setup) #18

Merged

plat merged 1 commit from feat/credential-boundary-provisioning into main

2026-07-01 04:22:35 +00:00

plat commented

2026-06-30 16:43:23 +00:00

Owner

Do NOT merge until validated on gc.local (per the #16 plan). Closes plat/mitosis#16. germinate sets protected-file-patterns on app workflows so a non-admin agent can't add a secret-dumping workflow. Note: the protectWorkflows rule-name semantics are Forgejo-version-dependent — gc.local check (d) must confirm an evil-workflow push is actually rejected.

**Do NOT merge until validated on gc.local** (per the #16 plan). Closes plat/mitosis#16. germinate sets protected-file-patterns on app workflows so a non-admin agent can't add a secret-dumping workflow. Note: the protectWorkflows rule-name semantics are Forgejo-version-dependent — gc.local check (d) must confirm an evil-workflow push is actually rejected.

plat added 1 commit

2026-06-30 16:43:23 +00:00

germinate: provision the credential boundary (plat/mitosis#16 ) fa5913baa1

Platform-level setup for the per-run deploy-key + scoped-token flow and
enforcement of protected CI workflow files on app repos.

- lib.sh: add protect_workflows(fj,auth,owner,repo) — idempotent POST/PATCH of
  an all-branches branch-protection rule whose protected_file_patterns forbid a
  non-admin pusher (the per-run SSH deploy key) from touching
  .forgejo|.gitea|.github/workflows/**, closing the toJSON(secrets) exfil vector.
  Admin pushers (germinate, dispatcher promote/merge) bypass, so plumbing is
  unaffected. Best-effort: never fails germinate.
- germinate: thread the in-cluster Forgejo SSH endpoint
  (forgejo-ssh.<ns>.svc.cluster.local:22) into the agents helmrelease as
  config.forgejoSsh (FORGEJO_SSH env), mirroring the appsDomain override; the
  dispatcher uses it to mint per-run deploy keys instead of embedding the admin
  PAT in the git remote.
- germinate: call protect_workflows on every re-pushed repo. This is also the
  migration path — when a seed was captured from a parent with built apps, those
  app repos ride along and come up protected at birth.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

plat referenced this pull request

2026-07-01 00:22:18 +00:00

self-serve secrets #2

plat referenced this pull request

2026-07-01 02:03:41 +00:00

/goal /ultracode-workflows [SPINE-3] land credential-boundary germinate provisioning (rebase PR #18) + reconcile branch-protect divergence #23

plat force-pushed feat/credential-boundary-provisioning from fa5913baa1 to f45b378b09

2026-07-01 03:17:06 +00:00

Compare

plat commented

2026-07-01 03:23:37 +00:00

Author

Owner

Rebased onto current main (58bd911: python3 flake fix #50, refreshed seed #20, per-domain DNS #12).

Conflict resolution: only bin/germinate conflicted (main added the in-cluster DNS block; this branch added the forgejoSsh override right after the appsDomain block). Resolved to keep both — the DNS block with its own fi, then the forgejoSsh block. flake.nix and genesis/seed.tar.gz took main's versions (the branch does not touch them). bin/lib.sh applied cleanly (append-only).

Rule divergence reconciled: germinate now emits the enforcing rule_name "**" (the branch-matching glob) instead of the inert rule_name "no-agent-workflows". On this Forgejo generation rule_name is the branch-glob AND the URL identifier (confirmed by the dispatcher's protectMain -> PATCH /branch_protections/main); a descriptive name matched a nonexistent branch and never bound. The PATCH convergence URL was updated to /branch_protections/%2A%2A.

Head f45b378, now mergeable. Validating on an isolated valid8c germination before merge.

Rebased onto current main (58bd911: python3 flake fix #50, refreshed seed #20, per-domain DNS #12). **Conflict resolution:** only bin/germinate conflicted (main added the in-cluster DNS block; this branch added the forgejoSsh override right after the appsDomain block). Resolved to keep **both** — the DNS block with its own fi, then the forgejoSsh block. flake.nix and genesis/seed.tar.gz took main's versions (the branch does not touch them). bin/lib.sh applied cleanly (append-only). **Rule divergence reconciled:** germinate now emits the **enforcing** rule_name "**" (the branch-matching glob) instead of the inert rule_name "no-agent-workflows". On this Forgejo generation rule_name is the branch-glob AND the URL identifier (confirmed by the dispatcher's protectMain -> PATCH /branch_protections/main); a descriptive name matched a nonexistent branch and never bound. The PATCH convergence URL was updated to /branch_protections/%2A%2A. Head f45b378, now mergeable. Validating on an isolated valid8c germination before merge.

plat merged commit 460a9dd478 into main

2026-07-01 04:22:35 +00:00

plat referenced this pull request from a commit

2026-07-01 04:22:36 +00:00

Merge pull request '#16: provision branch protection on .forgejo/workflows/** (+ deploy-key/scoped-token setup)' (#18) from feat/credential-boundary-provisioning into main

plat referenced this pull request

2026-07-01 04:22:37 +00:00

/goal /ultracode-workflows [SPINE-3] land credential-boundary germinate provisioning (rebase PR #18) + reconcile branch-protect divergence #23

plat referenced this pull request

2026-07-01 04:23:17 +00:00

/goal /ultracode-workflows [SPINE-2] fix ci-builder cold-start KEDA/runner stall (#19) + validate seed refresh (#14 / PR #20) #22

plat referenced this pull request