Repository navigation
Bind release App-token jobs to release environments - #159
Draft
luisleo526 wants to merge 6 commits into
Draft
luisleo526 wants to merge 6 commits into
luisleo526 wants to merge 6 commits into
Conversation
…ents and refuse a minting job without one (CR-304) release.yml `manual-pr` (dispatch-only) uses the `release` environment; pineforge-release.yml `reconcile`, release-report.yml `report` and release.yml `prepare` (automatic) use `release-bot`. A test refuses any workflow job that mints the App token without a literal environment. The jobs keep reading the same secret names. Not to be merged until the owner confirms the two environments and their secrets exist. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Raise the existing diagnostic explicitly after the unchanged environment predicate so assertion rewriting does not append explanation text. Preserve strict refusal assertions and the release environment policy.
Keep the release environment bindings and strict authorization diagnostics while incorporating current data main.
luisleo526
changed the title
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bind App-token minting jobs to literal, non-empty GitHub environments. The manual PR job uses
release; reconciliation, preparation and reusable release reporting userelease-bot. Workflow preflight accepts checkout aliases and checks that every resolved input stays within the supplied workflow directory before reading it.Validation for tree
fb4acde4fed107441b6354af9d4bb3dc69e68efb, preserved by the author-identity rebuild: 178 scoped cases passed (175 authorization cases and three release-contract smoke cases), with zero failures, errors or skips. This is one Python 3.12/AArch64 run; required hosted checks must pass on the exact head. Inverse sensitivity remains unproven, not waived.Keep this PR in draft until the owner confirms that
releaseandrelease-botexist with the App secret copies. Then complete the post-owner review, merge and one dry run per repository. Remove the old repository or organization secret copies only after the dry runs succeed. Reusable-workflow secret inheritance and release concurrency remain part of that runtime validation.