SRE-924: Mint the release token from a Vault-held key - #1597
Conversation
The App's private key was a plain repository secret, so any job in this repository could read it and mint an installation token for the whole installation. Vault now signs the App JWT with a non-exportable key and the token is scoped to this repository. Declaring `environment: main` is what resolves the Vault address and the Cloudflare Access credentials, and it puts the environment claim in the OIDC token for the Vault role to bind.
PR SummaryMedium Risk Overview It now runs under the The checkout and changesets steps still use Reviewed by Cursor Bugbot for commit 0bcde21. Bugbot is set up for automated code reviews on this repo. Configure here. |
There was a problem hiding this comment.
Pull request overview
This PR updates the Release GitHub Actions workflow to mint the GitHub App installation token via Vault (non-exportable key signing) instead of using a repository-stored App private key secret, and scopes the resulting token to this repository.
Changes:
- Switches token minting from
actions/create-github-app-tokenwith repo secrets to a Vault-backed custom action (hashintel/.github/.../github-app-token). - Adds
environment: mainand enables OIDC (permissions: id-token: write) to support Vault auth and environment-bound claims. - Passes Vault/Cloudflare Access configuration and repository scope into the token-minting step.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
The release shared an App with other automation. It now signs as block-protocol-release, whose key is the only one its Vault role can reach.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (1)
.github/workflows/release.yml:21
- This workflow pins a custom action to an unmerged commit SHA in
hashintel/.github. If that commit is rebased/force-pushed away before it lands on a protected branch/tag, GitHub Actions may become unable to resolve it, breaking releases. Consider repinning to the merged commit SHA (or a version tag) before merging this PR, if available.
uses: hashintel/.github/.github/actions/github-app-token@6235da521f7054945cf1ff9967708d40c745c6b4 # unmerged — re-pin to the merged SHA, not @main
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (1)
.github/workflows/release.yml:21
- The inline reference comment says
# main, but the PR description notes this is pinned to an unmerged commit from hashintel/.github#95. Keeping# mainhere is likely to mislead future readers about what’s actually pinned and when it should be updated.
uses: hashintel/.github/.github/actions/github-app-token@89ff06bc761f0c0491d87a766eccce5aae6190ea # main
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 3934aea. Configure here.
The release job authenticated as a GitHub App whose private key was a plain
repository secret, and minted an installation token with no repository scope. It
now signs the App JWT in Vault with a key that is not exportable, and the token it
exchanges that for reaches only this repository.
environment: mainis what resolves the Vault address and the Cloudflare Accesscredentials, and it puts the environment claim in the OIDC token so the Vault role
can bind it alongside the owner, repository, ref and workflow file.
Before this merges
VAULT_ADDR(var),CF_ACCESS_CLIENT_ID(var) andCF_ACCESS_CLIENT_SECRET(secret) have to exist in the
mainenvironmentplace, and has to be re-pinned once that merges
After a green run
BLOCK_PROTOCOL_GITHUB_WORKER_PRIVATE_KEYshould be deleted from thisrepository's secrets — this workflow was its only consumer, and leaving it in
place keeps the key reachable and defeats the change.
BLOCK_PROTOCOL_GITHUB_WORKER_APP_IDcan go with it; App ids are not secret.