feat(ci): mint the gateway token from a GitHub identity token - #1242
Draft
brandonleung wants to merge 6 commits into
Draft
feat(ci): mint the gateway token from a GitHub identity token#1242brandonleung wants to merge 6 commits into
brandonleung wants to merge 6 commits into
Conversation
The smoke test authenticates the mint with a personal API key, which the mint refuses; the run only passes because it falls back to the legacy gateway, and that fallback is going away. The workflow now asks GitHub for an identity token and passes it as POSTHOG_WIZARD_GATEWAY_TOKEN. The mint reads that bearer when it is set, so CI receives the same capped, program-pinned token a user's run gets. The personal key stays for API calls and for the legacy fallback, which must never see the identity token. The smoke-test step blanks the identity-token request variables, so the model-written code it runs in the sandbox cannot ask for tokens of its own. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Test against a Context Mill branch:
Add Results will be posted here when complete. |
A step-level env: block does not remove ACTIONS_ID_TOKEN_REQUEST_URL or ACTIONS_ID_TOKEN_REQUEST_TOKEN; the runner sets them back afterwards. The smoke test runs model-written code, and those two are permission to ask GitHub for a token naming any audience, so the shell drops them itself instead. The agent subprocess never needed them either, nor the minted identity token: all three join the host-only denylist that already strips the orchestration values. The minted log line now names which identity minted, so a CI run is separable from a user run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
…ut it The token was requested in its own workflow step, then aged through the build, pack and install before the mint read it. GitHub does not document how long one lives. The script now asks for it immediately before the wizard runs and drops the request variables before starting it, so the workflow step no longer needs to blank anything. A CI run whose mint refuses no longer falls back to the legacy gateway. The refusal a broken identity path produces is a 401, which the fallback admits, so a green smoke test could have hidden it while spending on the gateway this work exists to stop using. A run without id-token: write fails with that reason for the same purpose. The subprocess denylist takes the whole ACTIONS_ID_TOKEN_REQUEST namespace rather than the two names that exist today, and the minted log line names which identity minted rather than re-deriving it by comparing two secrets. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
The missing-permission branch said the run would quietly spend on the legacy path. A CI run that cannot mint now fails instead, so the comment names what failing there buys rather than what it prevents. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
gewenyu99
approved these changes
Sep 10, 2026
Opt in with WIZARD_CI_IDENTITY=github-actions. The request pair leaves the environment at import, and a renewal that fails for availability or is throttled keeps the live token with bounded retries. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Wizard CI in wizard-workbench and this repo's smoke test authenticate the gateway mint with a personal API key, which the mint refuses. They pass only because
--cifalls back to the legacy gateway, and posthog#96861 turns that off.Changes
Adds an opt-in GitHub Actions identity for the mint. Nothing changes until a workflow sets
WIZARD_CI_IDENTITY=github-actions.src/lib/ci-identity.tsasks GitHub for a fresh identity token before every mint, renewals included, because each token is single-use and lives five minutes.process.envwhen the module loads and is only sent over https to*.actions.githubusercontent.com, with redirects refused.gateway mint refusedgains arenewalflag.The name avoids the
POSTHOG_WIZARD_prefix, which yargs' strict env parsing rejects for unknown names. No workflow opts in here.Test plan
Why it is safe: the CLI only ever holds a capped
phe_token, and the request pair goes only to GitHub's token service.origin/main(29 pre-existing errors).LLM context
Authored by Claude Code (Opus 5); requires human review.