jfraeys/infra
Watch
1
0
Fork
You've already forked infra
 0
Code Issues 21 Pull requests 4 Projects Releases Packages Wiki Activity Actions

fix(ci): staging-validate's report job uses its own commit-status token; ./infra secrets set/delete/rename #291

Open
jfraeys wants to merge 3 commits from jfraeys/fix/report-status-token into main
pull from: jfraeys/fix/report-status-token
merge into: jfraeys:main
Conversation 0 Commits 3 Files changed 8 +161 -120
jfraeys commented 2026-10-19 17:19:14 -04:00
Owner
Copy link

Summary

 staging-validate `report` job
-  FORGEJO_TOKEN: secrets.CI_FORGEJO_COMMENT_TOKEN
+  FORGEJO_TOKEN: secrets.CI_FORGEJO_STATUS_TOKEN

 .forgejo/ci-secrets.yml
+  CI_FORGEJO_STATUS_TOKEN: CI_FORGEJO_STATUS_TOKEN

 secrets/vault.sops.yml
+  CI_FORGEJO_STATUS_TOKEN                 (106 -> 107 keys; names only checked)

 ./infra secrets
   keys | get KEY | sync | expiry
+  set KEY | delete KEY | rename OLD NEW     # every vault-set.py action; `set` reads stdin or a hidden prompt

CI_FORGEJO_STATUS_TOKEN is a write:repository token (bot user, collaborator on the app repos only), kept separate from CI_FORGEJO_COMMENT_TOKEN.

Evidence

  • Before: staging-validate run #865's report job: curl: (22) The requested URL returned error: 403 posting the commit status with the comment token; staging/validate stayed pending on the coaching-site commit.
    After: not yet run. The secret exists in Forgejo (sync-ci-secrets.py --apply); the real check is the next dispatch with report_repo/report_sha. CLI: 
    scripts/tests/test-infra-cli.sh: secrets set/delete/rename dispatch and usage errors -> all passed

Merge Danger

Door: two-way

Blast Radius: CI reporting

The vault change is additive (one key); the old token is untouched. Until the Forgejo secret is synced (done) and a dispatch carries report_* inputs, nothing uses the new token. A leaked write:repository token can write to every repo its user collaborates on, which is why it belongs to a bot user scoped to the app repos.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ

## Summary ```diff staging-validate `report` job - FORGEJO_TOKEN: secrets.CI_FORGEJO_COMMENT_TOKEN + FORGEJO_TOKEN: secrets.CI_FORGEJO_STATUS_TOKEN .forgejo/ci-secrets.yml + CI_FORGEJO_STATUS_TOKEN: CI_FORGEJO_STATUS_TOKEN secrets/vault.sops.yml + CI_FORGEJO_STATUS_TOKEN (106 -> 107 keys; names only checked) ./infra secrets keys | get KEY | sync | expiry + set KEY | delete KEY | rename OLD NEW # every vault-set.py action; `set` reads stdin or a hidden prompt ``` `CI_FORGEJO_STATUS_TOKEN` is a `write:repository` token (bot user, collaborator on the app repos only), kept separate from `CI_FORGEJO_COMMENT_TOKEN`. ## Evidence - **Before:** staging-validate run #865's `report` job: `curl: (22) The requested URL returned error: 403` posting the commit status with the comment token; `staging/validate` stayed `pending` on the coaching-site commit. **After:** not yet run. The secret exists in Forgejo (`sync-ci-secrets.py --apply`); the real check is the next dispatch with `report_repo`/`report_sha`. CLI: ```text scripts/tests/test-infra-cli.sh: secrets set/delete/rename dispatch and usage errors -> all passed ``` ## Merge Danger **Door:** two-way **Blast Radius:** CI reporting The vault change is additive (one key); the old token is untouched. Until the Forgejo secret is synced (done) and a dispatch carries `report_*` inputs, nothing uses the new token. A leaked `write:repository` token can write to every repo its user collaborates on, which is why it belongs to a bot user scoped to the app repos. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
CI_FORGEJO_COMMENT_TOKEN has no commit-status permission on the app repo (403 in run #865).
CI_FORGEJO_STATUS_TOKEN is a separate write:repository token on a bot user scoped to the app repos.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
Only keys/get were wired; adding a vault value meant knowing vault-set.py's path. set reads the
value from stdin or a hidden prompt, so it never appears on a command line.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
chore(secrets): add CI_FORGEJO_STATUS_TOKEN to the vault
All checks were successful
Lint / lint (pull_request) Successful in 2m28s
Details
Secret scan / scan (pull_request) Successful in 15s
Details
441969cad5
 
write:repository token for staging-validate's report job (replicated to Forgejo by sync-ci-secrets.py).

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ge5tovcwdEUBtPwUktsZZZ
All checks were successful
Lint / lint (pull_request) Successful in 2m28s
Details
Secret scan / scan (pull_request) Successful in 15s
Details
This pull request can be merged automatically.
You are not authorized to merge this pull request.
View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.
git fetch -u origin jfraeys/fix/report-status-token:jfraeys/fix/report-status-token
git switch jfraeys/fix/report-status-token

Merge

Merge the changes and update on Forgejo.

Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.

git switch main
git merge --no-ff jfraeys/fix/report-status-token
git switch jfraeys/fix/report-status-token
git rebase main
git switch main
git merge --ff-only jfraeys/fix/report-status-token
git switch jfraeys/fix/report-status-token
git rebase main
git switch main
git merge --no-ff jfraeys/fix/report-status-token
git switch main
git merge --squash jfraeys/fix/report-status-token
git switch main
git merge --ff-only jfraeys/fix/report-status-token
git switch main
git merge jfraeys/fix/report-status-token
git push origin main
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
jfraeys/infra!291
No description provided.