fix(releases): declare the protected environment secret contract #15

2026-10-10T14:41:03Z

KofTwentyTwo commented

2026-10-10 14:41:03 +00:00

(Migrated from github.com)

The v0.1.1 release passed all CI gates, checksums, and five provenance checks, but the publisher received an empty App key and stopped before creating a draft. Both v0.1.0 and v0.1.1 remain reserved; neither tag is moved or reused.

Pass only RELEASE_APP_PRIVATE_KEY by name from the release caller and require that name in the reusable workflow contract. GitHub resolves its value from the existing tag-only, reviewer-protected release environment. No repository secret, broad inheritance, permission increase, or propagation into nested CI is added. Correct the setup documentation and mark the failed changelog entry unpublished.

Validation: actionlint; zizmor (no findings); Markdown lint; required PR CI. The next release proposal must be 0.1.2, the first published 0.1 series bundle.

GitHub documents the exact environment-secret behavior: https://docs.github.com/en/enterprise-cloud@latest/actions/how-tos/reuse-automations/reuse-workflows#using-inputs-and-secrets-in-a-reusable-workflow

AI assistance: implementation and verification by OpenAI GPT-6 Codex, under maintainer authorization.

The v0.1.1 release passed all CI gates, checksums, and five provenance checks, but the publisher received an empty App key and stopped before creating a draft. Both v0.1.0 and v0.1.1 remain reserved; neither tag is moved or reused. Pass only `RELEASE_APP_PRIVATE_KEY` by name from the release caller and require that name in the reusable workflow contract. GitHub resolves its value from the existing tag-only, reviewer-protected `release` environment. No repository secret, broad inheritance, permission increase, or propagation into nested CI is added. Correct the setup documentation and mark the failed changelog entry unpublished. Validation: actionlint; zizmor (no findings); Markdown lint; required PR CI. The next release proposal must be 0.1.2, the first published 0.1 series bundle. GitHub documents the exact environment-secret behavior: https://docs.github.com/en/enterprise-cloud@latest/actions/how-tos/reuse-automations/reuse-workflows#using-inputs-and-secrets-in-a-reusable-workflow AI assistance: implementation and verification by OpenAI GPT-6 Codex, under maintainer authorization.

KofTwentyTwo commented

2026-10-10 14:41:42 +00:00

(Migrated from github.com)

AI review of commit 960510c: no unresolved findings.

The caller passes one named secret; the reusable workflow requires its name and resolves its value only in the reviewer-protected, tag-only release job. The nested gates receive no secrets. Permissions, runner choices, Action pins, draft-first publication, and immutable-release checks are unchanged. The required declaration catches an omitted caller contract during workflow validation; GitHub documents that it does not test whether the stored value is nonempty.

Verified locally: actionlint; zizmor with no findings; Markdown lint with zero issues; git diff whitespace check. An ignored old package rehearsal caused the initial Markdown run to inspect generated release notes; the rehearsal was moved into the validation cache and the repository check then passed. Required remote CI still governs merging.

Operational limitation: live publication with the corrected contract is verified by the next signed source version, not by rewriting v0.1.1. Neither failed tag is reused.

AI review of commit 960510c: no unresolved findings. The caller passes one named secret; the reusable workflow requires its name and resolves its value only in the reviewer-protected, tag-only `release` job. The nested gates receive no secrets. Permissions, runner choices, Action pins, draft-first publication, and immutable-release checks are unchanged. The required declaration catches an omitted caller contract during workflow validation; GitHub documents that it does not test whether the stored value is nonempty. Verified locally: actionlint; zizmor with no findings; Markdown lint with zero issues; git diff whitespace check. An ignored old package rehearsal caused the initial Markdown run to inspect generated release notes; the rehearsal was moved into the validation cache and the repository check then passed. Required remote CI still governs merging. Operational limitation: live publication with the corrected contract is verified by the next signed source version, not by rewriting v0.1.1. Neither failed tag is reused.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/standards#15