docs: correct GitHub App credential lifecycle guidance - #64
Conversation
|
@codex review Please review exact head: |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 163caf78e6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b63bc0003
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 62d16099a4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e32a1046dc
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 658eda7c94
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9801048a2b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 23b00794b8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7eed9e777b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7f54a7d91b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c3d4572d75
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5144ca7c7d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b760079c9d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d41085c9f2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bbddb39bc0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 972f44b85e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. What shall we delve into next? Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: df65e90d1d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5bf859235d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| test -n \"\$dir\" || dir=/; | ||
| done; | ||
| } | ||
| test \"\$(stat -c '%F' -- \"$PEM_DEST\")\" = 'regular file' && |
There was a problem hiding this comment.
On a controller whose SSH session uses a translated locale, %F may not produce the literal English text regular file; stat --help describes %F as the “file type in human readable form.” This rejects an otherwise valid manager-backed PEM before checksum verification and prevents installation or rotation. Force LC_ALL=C for this command or use a locale-independent file predicate instead.
AGENTS.md reference: AGENTS.md:L5-L5
Useful? React with 👍 / 👎.
| [[ "$replacement_pubkey_sha" =~ ^[0-9a-f]{64}$ ]] || exit 1 | ||
| if [[ -n "$ACTIVE_PEM" ]]; then | ||
| [[ $ACTIVE_PEM =~ ^/[A-Za-z0-9._/-]+$ ]] || exit 1 | ||
| [[ "$PEM_DEST" != "$ACTIVE_PEM" ]] || exit 1 |
There was a problem hiding this comment.
During a manager-backed rotation, a destination such as /etc/ci-fleet/secrets/../secrets/github-app.pem passes this lexical inequality check even when it resolves to ACTIVE_PEM. The manager import is performed before the controller-side canonicality check at line 130, so it can replace the active material before verification fails. Fresh evidence after the earlier equality and canonicality guards is this remaining post-import ordering; resolve and compare both paths on the controller before invoking the manager import.
AGENTS.md reference: AGENTS.md:L66-L66
Useful? React with 👍 / 👎.
| RESOLVED_LOCAL_PEMS+=("$backing") | ||
| [[ "$pem" == "$backing" ]] || RESOLVED_LOCAL_PEMS+=("$pem") |
There was a problem hiding this comment.
When LOCAL_PEMS contains the configured backing path plus another retained symlink to that path, resolving each entry appends the configured path twice—once directly and once as the symlink's backing—while the instructions require listing every retained path. The later configured_classifications == 1 check then fails before inventory persistence, uninstall, or PEM removal, blocking retirement. Deduplicate the resolved array or classify the original arrays before adding backing paths.
Useful? React with 👍 / 👎.
|
Superseded and intentionally never merged by #65, which was squash-merged as This PR’s 25 commits, 733 added lines, and 60 review threads are useful architectural evidence: security-sensitive credential lifecycle execution should not become an unbounded Markdown shell state machine. Tested provider-specific automation remains tracked by #27. The unresolved threads here are preserved as historical evidence rather than falsely resolved. |
2 participants
Summary
Repairs the five unresolved-in-substance documentation findings from #55 without changing runtime behavior:
Adds one small documentation contract to prevent an unredirected
github-app-token.shcommand from returning.Historical finding mapping
3662186231→ sections 6. Pre-install verification and Key rotation, where both direct token-helper commands end in>/dev/null;scripts/test_quickstart.pyenforces this.3662186235→ Key rotation: activate and verify before revocation followed by Old-key revocation; normal reconciliation, a fresh health check, and installed-ref convergence must all succeed before GitHub revocation.3662186238→ Controller retirement and PEM removal; uninstall installation access, revoke every GitHub key, uninstall the controller, then explicitly remove preserved host PEM and host identity files.3662186239→ separate Pre-install verification from the reviewed checkout and Post-install remote-reconciliation verification sections.3662186244→ Generate and transfer the private key; authenticated encrypted transfer writes directly to the final root-owned path, checksum and mode are verified, then workstation copies are removed under the applicable secure-erasure policy.Validation
python3 scripts/test_quickstart.py— PASS*.md— PASSgit diff --check— PASSshellcheck scripts/*.sh examples/project/scripts/ci/*.sh templates/config-repository/scripts/*.sh— PASSpython3 scripts/scan_committed_secrets.py --commit <head>— PASSpython3 scripts/scan_committed_secrets.py --commit-range <base>..<head>— PASSscripts/validate.sh— all Python, policy, capacity, and installer tests passed; local run then stopped at the Docker Compose validation because Docker is not installed in this repository-only session. Draft PR CI is expected to exercise the Docker-backed remainder.Merge
Draft only. An independent merge-only session must wait for required CI and exact-head Codex review; this implementation session will not merge.