SRE-924: Mint the release token from a Vault-held key - #1597
Conversation
Sorry, something went wrong.
The App's private key was a plain repository secret, so any job in this repository could read it and mint an installation token for the whole installation. Vault now signs the App JWT with a non-exportable key and the token is scoped to this repository. Declaring `environment: main` is what resolves the Vault address and the Cloudflare Access credentials, and it puts the environment claim in the OIDC token for the Vault role to bind.
PR SummaryMedium Risk Overview It now runs under the main GitHub environment, requests id-token: write, and calls hashintel/.github’s github-app-token action with Vault (VAULT_ADDR, role ci-blockprotocol-release, transit key github-app-block-protocol-release) and Cloudflare Access credentials so the App JWT is signed with a non-exportable key and the resulting token is limited to this repository. The checkout and changesets steps still use steps.app-token.outputs.token as before. Reviewed by Cursor Bugbot for commit 0bcde21. Bugbot is set up for automated code reviews on this repo. Configure here. |
Sorry, something went wrong.
There was a problem hiding this comment.
Pull request overview
This PR updates the Release GitHub Actions workflow to mint the GitHub App installation token via Vault (non-exportable key signing) instead of using a repository-stored App private key secret, and scopes the resulting token to this repository.
Changes:
- Switches token minting from actions/create-github-app-token with repo secrets to a Vault-backed custom action (hashintel/.github/.../github-app-token).
- Adds environment: main and enables OIDC (permissions: id-token: write) to support Vault auth and environment-bound claims.
- Passes Vault/Cloudflare Access configuration and repository scope into the token-minting step.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sorry, something went wrong.
The release shared an App with other automation. It now signs as block-protocol-release, whose key is the only one its Vault role can reach.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (1).github/workflows/release.yml:21
- This workflow pins a custom action to an unmerged commit SHA in hashintel/.github. If that commit is rebased/force-pushed away before it lands on a protected branch/tag, GitHub Actions may become unable to resolve it, breaking releases. Consider repinning to the merged commit SHA (or a version tag) before merging this PR, if available.
uses: hashintel/.github/.github/actions/github-app-token@6235da521f7054945cf1ff9967708d40c745c6b4 # unmerged — re-pin to the merged SHA, not @main
Sorry, something went wrong.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (1).github/workflows/release.yml:21
- The inline reference comment says # main, but the PR description notes this is pinned to an unmerged commit from hashintel/.github#95. Keeping # main here is likely to mislead future readers about what’s actually pinned and when it should be updated.
uses: hashintel/.github/.github/actions/github-app-token@89ff06bc761f0c0491d87a766eccce5aae6190ea # main
Sorry, something went wrong.
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3934aea. Configure here.
Sorry, something went wrong.
The release job authenticated as a GitHub App whose private key was a plain
repository secret, and minted an installation token with no repository scope. It
now signs the App JWT in Vault with a key that is not exportable, and the token it
exchanges that for reaches only this repository.
environment: main is what resolves the Vault address and the Cloudflare Access
credentials, and it puts the environment claim in the OIDC token so the Vault role
can bind it alongside the owner, repository, ref and workflow file.
Before this merges
(secret) have to exist in the main environment
place, and has to be re-pinned once that merges
After a green run
BLOCK_PROTOCOL_GITHUB_WORKER_PRIVATE_KEY should be deleted from this
repository's secrets — this workflow was its only consumer, and leaving it in
place keeps the key reachable and defeats the change.
BLOCK_PROTOCOL_GITHUB_WORKER_APP_ID can go with it; App ids are not secret.