Repository navigation
ci: automate release acceptance and clarify installation - #332
Conversation
|
| GitGuardian id | GitGuardian status | Secret | Commit | Filename | |
|---|---|---|---|---|---|
| 39147314 | Triggered | Username Password | f62cba8 | scripts/ci/business-acceptance.sh | View secret |
🛠 Guidelines to remediate hardcoded secrets
- Understand the implications of revoking this secret by investigating where it is used in your code.
- Replace and store your secret safely. Learn here the best practices.
- Revoke and rotate this secret.
- If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.
To avoid such incidents in the future consider
- following these best practices for managing and storing secrets including API keys and other credentials
- install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.
🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Problem and changes
The installation entry points created configuration before the clean-install guide required it to be absent, and release guidance still described the published baseline as unreleased. Route readers to released images, a separate empty-volume install, or the existing upgrade path before configuration; pin ordinary installation to v1.0.4 and connect durable downloads/checksums/signatures to existing TLS/Judge/readiness/rollback gates.
Require real migration and business acceptance in ci-ok for selected runtime/frontend/install/full-release changes. A real MySQL fresh/upgrade/FK/backfill/backup/isolation drill precedes one isolated stack running actual Auth, Management, Console and Judge services. Generated identities use expiring manager permissions and an ordinary USER participant; artifacts contain only sanitized JSON reports.
Fix authenticated mutation replay by attaching the rotated CSRF token after refresh while retaining the payload, account binding and single retry. Preserve server errors on internal App ERROR dispatches instead of masking RPC failures as 401; ordinary requests, including direct /error, remain protected. Admin readiness checks the problem-read/test-case-write consumers. Submission waits for both projection consumers before its launcher readiness marker, with a bounded discovery deadline and current-start log offsets. Discovery checks never invoke RPC methods or retry writes.
Prepare owner versions 1.0.5 consistently in the seven owner/reactor declarations and strict supply-chain contract for the next complete source-matched image set. The seven prospective tags were checked absent; existing v1.0.4 tags/assets are unchanged.
Add read-only eight-asset packaging from exact clean source and complete signed nine-image evidence. Bind evidence to the exact successful canonical ci.yml main run, verify hashes/signatures/provenance/scan and every promoted tag digest, reject incomplete/tampered/conflicting inputs, and preserve identical outputs. The tool does not build, tag or publish.
Validation
CI 40521143534 completed successfully at exact head
effb087980b3659c4e6e03c27972483a94911afe: 29 successful jobs including ci-ok; publish skipped.Formal GitHub Release creation and production deployment are outside this change. Main-only protection was applied after acceptance succeeded and independently read back: require PR, ci-ok from Actions app 15368 with strict up-to-date checks, zero additional approving reviews, admin enforcement, no force pushes or deletion. Code-owner and last-push approvals are not required. The local retained-fixture recheck also passed all 14 checks using the supported system-Chromium override; hosted acceptance used the locked browser. Cleanup is verified: no owned containers or PM2 apps remain, the empty private daemon is stopped, and all five disposable volumes are preserved.
External check note: GitGuardian reports a Password finding at historical commit f62cba8, scripts/ci/business-acceptance.sh line 60. That line creates the disposable participant password at runtime using secrets.token_hex(20); the committed prefix/generator expression is not a usable credential. The external result remains failed and was not disabled, dismissed or represented as passed. Required ci-ok and all 29 CI jobs passed.
Traceability: DAV-72.