Repository navigation
fix(security): pin caller ref to a tag, pass secrets explicitly (DEC-081) - #58
Merged
Merged
Conversation
…081) Reach was 24 repos, not 4 — including agent-zero-new-plugin-template, so every future plugin inherited it. @main does not just mean "mutable": it means every merge to the devkit goes live in 24 repos CI immediately and unreviewed. Three fleet-wide regressions already came through that path — DEC-079 closed 18 sync PRs (4 already green), DEC-073 left every consumer green while shipping 0 traces, DEC-075 made every Dependabot PR structurally red. A tag is movable by the same principal, so it is not a boundary against an insider; what changes is the DEFAULT. main advances on every merge, a tag only on a deliberate act, and forgetting to bump fails safe. secrets: inherit forwards every repo- AND org-level secret, including ones added later and ones the workflow never declares. The reusable workflow declares exactly three, all required:false, so the explicit list is a strict superset of what it consumes and breaks nothing. It also closes a gap I could not otherwise verify: org secrets are not enumerable without admin:org, and inherit forwards those too. devkit-sync.caller.yml already did this — this aligns the other caller rather than inventing a convention. Rated honestly: confidentiality LOW (one org member, zero forks, no outside collaborators; the exposed material is a read-only package token plus an App key whose job vanished when the devkit went public). The real cost is integrity and blast radius — one unreviewed merge changes CI in 24 repos with no canary.
omar-nahhas
force-pushed
the
fix/pin-caller-ref-explicit-secrets
branch
from
August 5, 2026 00:25
cd59814 to
4adbc20
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes C4.
Corrected scope
I reported this as affecting 4 repos. It is 24 — verified by enumerating the org: 25 repos carry the
plugin-e2ecaller, 24 of them usesecrets: inherit. That includesagent-zero-new-plugin-template, so every future plugin inherited it.Why the tag
@mainisn't merely mutable — it means every merge to the devkit goes live in 24 repos' CI immediately, unreviewed. Not hypothetical; three fleet-wide regressions in this SPEC came through exactly that path:A tag is movable by the same principal who could push
main, so it is not a boundary against an insider. What changes is the default:mainadvances automatically on every merge; a tag only on a deliberate act. Forgetting to bump fails safe.Why explicit secrets
inheritforwards every repo- and org-level secret — including ones added later and ones the workflow never declares. The reusable workflow declares exactly three, allrequired: false, so the explicit list is a strict superset of what it consumes and breaks nothing. It also closes a gap I can't otherwise verify: org secrets aren't enumerable withoutadmin:org, andinheritwould forward those too.devkit-sync.caller.ymlalready passed secrets explicitly — this aligns the other caller rather than inventing a convention.Rated honestly
Confidentiality: low. One org member, zero forks, no outside collaborators; the material at risk is a read-only package token plus an App key whose job vanished when the devkit went public.
Integrity / blast radius: medium. One unreviewed merge changes CI in 24 repos with no canary and no rollback boundary. Fixed as change management, not as a breach.
Sequencing
This template names
@v2.1.6, and that tag does not exist yet — I merged the release changelog and called it released without tagging. The tag must be cut on this commit or later, or it would ship a caller still pointing at@main.Propagation to 24 repos is a separate, staged rollout — one repo first, verify green, then the rest.