Repository navigation
ci(health): manual, read-only health check that flags personal tokens - #6
Merged
Merged
Conversation
Read each active workflow file on every tracked branch and flag any secret other than GITHUB_TOKEN. Automation running under a personal token got a maintainer's account suspended; this makes it visible the day it returns. Disabled workflows are skipped, so turning one off in the Actions settings clears the finding. A repository that genuinely needs another secret lists it under allowed_secrets in repos.json. The tests also pin TechMachine's own workflows and the generated satellite workflows to GITHUB_TOKEN only.
The health check no longer runs on a schedule, updates the Org health report issue, or mentions anyone. A person starts it from the Actions tab and the report goes to the run's step summary. An account here was suspended over automation, so nothing in this repository acts on its own. The workflow keeps GITHUB_TOKEN with read-only permissions. Every action in health.yml and test.yml is a GitHub-owned action pinned by full SHA. TechAPI's label-triggered final check is the one sanctioned use of TechEngineBot's token, so it is allowed for that repository only.
Seungpyo1007
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The health check is now run by hand and writes nothing to GitHub. It also reports any workflow in the org that runs under a personal token.
Health check: manual and write-free
health.ymlonly hasworkflow_dispatch; the daily schedule is gone.--issue, the alert fingerprint andnotifyare removed, and the report goes to the run's step summary.GITHUB_TOKENkeeps read-only permissions (contents: read,actions: read).Personal-token check
GITHUB_TOKENis reported.allowed_secretsinrepos.jsonpermits a specific secret per repository. Only TechAPI uses it, forTECHENGINEBOT_TOKEN(its label-triggered final check).GITHUB_TOKENonly.Actions
health.ymlandtest.ymluse only GitHub-owned actions pinned by full SHA: checkout3d3c42e(v7.0.1), setup-python6d4fd22(v7.1.0).test.ymlnow declarescontents: read.Checked locally
python -m pytest -q: 18 passed.python -m machine.healthagainst the org: all clear.