[BryanLawless]

The first Main run after the promotion failed in Merge main into dev. The called sync-dev.yml job received an empty SNAPFLOW_AUTOMATION_PRIVATE_KEY, even though its job sets environment: automation. The release-please job in the same run read the same secret fine, because it's defined directly in main.yml.

• sync-dev.yml now runs as its own workflow on pushes to main, so it reads the automation environment directly. It never needed anything from main.yml.
• main.yml now passes secrets: inherit to release.yml, which needs release-please's outputs and the beta environment's R2 and TUF keys. The zizmor secrets-inherit finding is suppressed with a reason.

Checked locally: actionlint passes, and zizmor reports only the existing low-severity self-repository hints.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 06b7f959-3f18-4feb-82ae-629e5c21d8b8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.