Skip to content

Read public fleet workflow metadata without private credentials - #28

Merged
omry merged 1 commit into
mainfrom
pr28
Oct 19, 2026
Merged

Read public fleet workflow metadata without private credentials#28
omry merged 1 commit into
mainfrom
pr28

Conversation

@omry

@omry omry commented Oct 19, 2026

Copy link
Copy Markdown
Contributor

Fleet setup checks were sending the private monitoring token to public central workflow repositories. Organization token-lifetime policies could then reject the scan even when the same public data was available anonymously.

Use a separate cached unauthenticated client for the pinned central contract, toolchain and reusable workflows. Keep authenticated reads for inventory, monitored project files and Actions state. Anonymous failures remain unverified without retrying the private credential.

Document the read boundary and current public inventory. Regression coverage reproduces token-policy rejection, retained private read authorization, anonymous failure and snapshot reuse. All 1,097 public tests, lint, formatting and runtime types pass.

@omry
Read public fleet workflow metadata without private credentials
4b6da98 
Fleet setup checks were sending the private monitoring token to public central workflow repositories. Organization token-lifetime policies could then reject the scan even when the same public data was available anonymously.

Use a separate cached unauthenticated client for the pinned central contract, toolchain and reusable workflows. Keep authenticated reads for inventory, monitored project files and Actions state. Anonymous failures remain unverified without retrying the private credential.

Document the read boundary and current public inventory. Regression coverage reproduces token-policy rejection, retained private read authorization, anonymous failure and snapshot reuse. All 1,097 public tests, lint, formatting and runtime types pass.
@omry

omry commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

PR-cycle state — maintained automatically. Do not edit by hand.

Mechanical PR-cycle state (JSON) 
{
  "approval": {
    "candidate_revision_fingerprint": "sha256:b3a2fa57a1b9f75a22f43e8e8c205649b75b5688ffab4b26b237a53f843934fa",
    "evidence": {
      "attestations": [],
      "candidate_revision_fingerprint": "sha256:b3a2fa57a1b9f75a22f43e8e8c205649b75b5688ffab4b26b237a53f843934fa",
      "check_conclusions": [
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 117955714628
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 117955715253
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 117955715341
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 117955715415
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 117955715519
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 117955715151
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 117955715032
        }
      ],
      "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "finding_dispositions_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
      "operation_identity": "sha256:26260c7664b822fb4331f2385ce70f11855278ece025619b7f5625c2526e20bd",
      "review_request": {
        "body_digest": "sha256:2573652f3bff31ce1e4f0bf1959c3324dd3ea3c099169148912a094351c36f01",
        "id": 6262729892
      },
      "review_result": {
        "body_digest": "sha256:48d3dd050afaeb5945d61fa1aa831f7acb157d828d8b93842145bda2ac99db46",
        "id": 6262756560
      }
    },
    "evidence_fingerprint": "sha256:f62b0d8f663537352370bf74acfb6dc9e15ba13304c5e84140e62ab1440b6ba3",
    "head_sha": "4b6da9842bdac710b2cca176597c565fd9c53a1c",
    "operation_identity": "sha256:26260c7664b822fb4331f2385ce70f11855278ece025619b7f5625c2526e20bd",
    "review_request_id": 6262729892,
    "review_result_id": 6262756560,
    "status": "approved-evidence-recorded"
  },
  "candidate_revision_fingerprint": "sha256:b3a2fa57a1b9f75a22f43e8e8c205649b75b5688ffab4b26b237a53f843934fa",
  "check_conclusions": [
    {
      "conclusion": "SUCCESS",
      "name": "test",
      "run_id": 117955714628
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, npm, 11.9.0)",
      "run_id": 117955715253
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.20.0)",
      "run_id": 117955715341
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (22, pnpm, 11.21.0)",
      "run_id": 117955715415
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, npm, 11.9.0)",
      "run_id": 117955715519
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.20.0)",
      "run_id": 117955715151
    },
    {
      "conclusion": "SUCCESS",
      "name": "toolchain (24, pnpm, 11.21.0)",
      "run_id": 117955715032
    }
  ],
  "check_observations": [
    {
      "checks": [
        {
          "conclusion": "SUCCESS",
          "name": "test",
          "run_id": 117955714628,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39220909379/job/117955714628"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, npm, 11.9.0)",
          "run_id": 117955715253,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39220909379/job/117955715253"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.20.0)",
          "run_id": 117955715341,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39220909379/job/117955715341"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (22, pnpm, 11.21.0)",
          "run_id": 117955715415,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39220909379/job/117955715415"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, npm, 11.9.0)",
          "run_id": 117955715519,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39220909379/job/117955715519"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.20.0)",
          "run_id": 117955715151,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39220909379/job/117955715151"
        },
        {
          "conclusion": "SUCCESS",
          "name": "toolchain (24, pnpm, 11.21.0)",
          "run_id": 117955715032,
          "run_status": "completed",
          "status": "success",
          "url": "https://github.com/hydra-ecosystem/github-actions/actions/runs/39220909379/job/117955715032"
        }
      ],
      "head_sha": "4b6da9842bdac710b2cca176597c565fd9c53a1c",
      "id": "sha256:7b7aaa9534afe340190e25f195516a30efd1b7eabf67d1bba249f728a230f109",
      "required_checks": [
        "test",
        "toolchain (22, npm, 11.9.0)",
        "toolchain (22, pnpm, 11.20.0)",
        "toolchain (22, pnpm, 11.21.0)",
        "toolchain (24, npm, 11.9.0)",
        "toolchain (24, pnpm, 11.20.0)",
        "toolchain (24, pnpm, 11.21.0)"
      ],
      "status": "success"
    }
  ],
  "delivery_deferral_ledger_digest": "sha256:4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945",
  "delivery_deferrals": [],
  "findings": [],
  "pr": {
    "base_ref": "main",
    "base_sha": "c966afa288a75f04bd00d782a047250cc5d430b4",
    "body_digest": "sha256:477bad31da138389e59b47e302023679755fd8b17928b62a02eb11b47c6f12c6",
    "diff_digest": "sha256:e2f4f36109f06c475eb6b5e76ec36d327bf9f01c2db6ed0977756d012793a19e",
    "head_ref": "pr28",
    "head_sha": "4b6da9842bdac710b2cca176597c565fd9c53a1c",
    "pr": 28,
    "repository": "hydra-ecosystem/github-actions",
    "scope_authority": [],
    "title_digest": "sha256:34c9255acf06912e3a009e88b944df026273db66ec36d64372d26036bffd5ebe"
  },
  "record_version": 4,
  "review_observations": [],
  "review_requests": [
    {
      "base_established_at": "2026-10-19T08:10:35Z",
      "base_ref": "main",
      "base_sha": "c966afa288a75f04bd00d782a047250cc5d430b4",
      "body_digest": "sha256:2573652f3bff31ce1e4f0bf1959c3324dd3ea3c099169148912a094351c36f01",
      "created_at": "2026-10-19T08:12:39Z",
      "head_sha": "4b6da9842bdac710b2cca176597c565fd9c53a1c",
      "id": 6262729892,
      "kind": "regular-review"
    }
  ],
  "review_results": [
    {
      "base_ref": "main",
      "base_sha": "c966afa288a75f04bd00d782a047250cc5d430b4",
      "body_digest": "sha256:48d3dd050afaeb5945d61fa1aa831f7acb157d828d8b93842145bda2ac99db46",
      "commit_id": "4b6da9842bdac710b2cca176597c565fd9c53a1c",
      "id": 6262756560,
      "inline_message_ids": [],
      "request_comment_id": 6262729892,
      "result_kind": "clean",
      "status": "result",
      "submitted_at": "2026-10-19T08:14:09Z",
      "unresolved_thread_ids": []
    }
  ],
  "revision_fingerprint": "sha256:b3a2fa57a1b9f75a22f43e8e8c205649b75b5688ffab4b26b237a53f843934fa",
  "rounds": [
    {
      "applied_fix_paths": [],
      "disposition_changes": [],
      "effective_diff_digest": "sha256:e2f4f36109f06c475eb6b5e76ec36d327bf9f01c2db6ed0977756d012793a19e",
      "finding_ids": [],
      "invariants": [
        "Public central reads use no private token; inventory/project/Actions reads retain their credential; anonymous failure remains unverified"
      ],
      "outcome": "clean",
      "proposed_fix_paths": [],
      "resulting_head": "4b6da9842bdac710b2cca176597c565fd9c53a1c",
      "review_observation_id": null,
      "review_request_id": 6262729892,
      "review_result_id": 6262756560,
      "reviewed_head": "4b6da9842bdac710b2cca176597c565fd9c53a1c",
      "root_cause": null,
      "round": 1,
      "unresolved_current_slice_findings": 0,
      "unresolved_design_blockers": 0
    }
  ],
  "schema": "awd:swe:pr-cycle-state",
  "version": 2
}

@omry
omry marked this pull request as ready for review October 19, 2026 08:11
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-19T08:14:10.281687Z 4b6da98 Manual request
🔒 Security Review ✅ Completed 2026-10-19T08:14:12.600853Z 4b6da98 Draft marked ready
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@omry

omry commented Oct 19, 2026

Copy link
Copy Markdown
Contributor Author

@codex, regular review 4b6da98

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 19, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 4b6da9842b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@omry omry added the approved label Oct 19, 2026
@omry
omry merged commit fc4a805 into main Oct 19, 2026
7 checks passed
@omry
omry deleted the pr28 branch October 19, 2026 08:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

approved

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@omry