fix(ci): add Infisical canary bridge #91

Merged

pdurlej merged 1 commit from codex/ci/infisical-canary-bridge into main

2026-05-05 23:54:31 +02:00

codex commented

2026-05-05 23:49:24 +02:00

Collaborator

Canary Context Pack

Product story

Canary review should not depend on raw Forgejo repo secrets. It should only run when the trusted rs2000 runner can prove it has a machine-local env generated from Infisical and the local reviewer CLIs needed for the 3+3 contract.

What changed

Added control-plane/platformctl/ci/write_canary_env.py to generate canary.env from Infisical Universal Auth without printing secret values.
Hardened canary_readiness.py so readiness requires bridge metadata, 0600 permissions, PLATFORMCTL_ZAI_API_KEY, and available claude/codex commands.
Updated canary workflow bootstrap JSON for the expanded readiness schema.
Documented the runner-local bridge, artifacts, and morning canary plan.
Added contract tests for handwritten-env rejection and bridge env generation.

Why it changed

After #89, canary correctly stopped using direct ZAI_API_KEY / CANARY_FORGEJO_TOKEN repo secrets, but it could only report not_configured. This PR adds the missing repo-owned bridge contract so the next operational step is explicit: rs2000 machine entity → Infisical → generated env file → readiness gate.

Files touched

.forgejo/workflows/canary-required.yml
control-plane/platformctl/ci/canary_readiness.py
control-plane/platformctl/ci/write_canary_env.py
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
control-plane/pyproject.toml
docs/ci/*
runbooks/forgejo-actions-runner.md
state/canary/CANARY_PLAN.md

Relevant context

#89 removed direct provider/comment-token repo secret dependency.
#84 merged the SSH agent cleanup split.
Operator explicitly wants Infisical as the source of truth, not ZAI_API_KEY or canary tokens in Forgejo repo secrets.
The current runner still may not expose Claude/Codex CLI subscription auth to job containers; readiness now reports that honestly instead of half-enabling canary.

Verification

python3 -m py_compile control-plane/platformctl/ci/write_canary_env.py control-plane/platformctl/ci/canary_readiness.py
python3 -m pytest -q control-plane/platformctl/tests -> 166 passed
python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --json /tmp/platform-workflow-lint.json --markdown /tmp/platform-workflow-lint.md -> 0 findings
python3 control-plane/platformctl/ci/check_docs_drift.py --root . --json /tmp/platform-docs-drift.json --markdown /tmp/platform-docs-drift.md -> 0 findings
pyfallow analyze --root control-plane --format agent-fix-plan --output /tmp/platform-p0-pyfallow-infisical-bridge.json --fail-on error --min-confidence medium -> blocking=0

Known constraints

This PR does not install or authenticate Claude/Codex CLI on the runner. It makes readiness fail closed until that environment exists.

Explicit out-of-scope

Adding provider keys to Forgejo repo secrets
Restarting or changing rs2000 runner service
Deploying to vps1000
Changing canary reviewer providers
Posting Forgejo canary comments for real

Requested decision

Merge if the bridge contract is the right next step: no repo-level provider secrets, machine-local Infisical source, and honest readiness until CLI auth exists.

## Canary Context Pack ### Product story Canary review should not depend on raw Forgejo repo secrets. It should only run when the trusted rs2000 runner can prove it has a machine-local env generated from Infisical and the local reviewer CLIs needed for the 3+3 contract. ### What changed - Added `control-plane/platformctl/ci/write_canary_env.py` to generate `canary.env` from Infisical Universal Auth without printing secret values. - Hardened `canary_readiness.py` so readiness requires bridge metadata, `0600` permissions, `PLATFORMCTL_ZAI_API_KEY`, and available `claude`/`codex` commands. - Updated canary workflow bootstrap JSON for the expanded readiness schema. - Documented the runner-local bridge, artifacts, and morning canary plan. - Added contract tests for handwritten-env rejection and bridge env generation. ### Why it changed After #89, canary correctly stopped using direct `ZAI_API_KEY` / `CANARY_FORGEJO_TOKEN` repo secrets, but it could only report `not_configured`. This PR adds the missing repo-owned bridge contract so the next operational step is explicit: rs2000 machine entity → Infisical → generated env file → readiness gate. ### Files touched - `.forgejo/workflows/canary-required.yml` - `control-plane/platformctl/ci/canary_readiness.py` - `control-plane/platformctl/ci/write_canary_env.py` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `control-plane/pyproject.toml` - `docs/ci/*` - `runbooks/forgejo-actions-runner.md` - `state/canary/CANARY_PLAN.md` ### Relevant context - #89 removed direct provider/comment-token repo secret dependency. - #84 merged the SSH agent cleanup split. - Operator explicitly wants Infisical as the source of truth, not `ZAI_API_KEY` or canary tokens in Forgejo repo secrets. - The current runner still may not expose Claude/Codex CLI subscription auth to job containers; readiness now reports that honestly instead of half-enabling canary. ### Verification - `python3 -m py_compile control-plane/platformctl/ci/write_canary_env.py control-plane/platformctl/ci/canary_readiness.py` - `python3 -m pytest -q control-plane/platformctl/tests` -> `166 passed` - `python3 control-plane/platformctl/ci/lint_workflows.py --policy .forgejo/ci-policy.yaml --workflows .forgejo/workflows --json /tmp/platform-workflow-lint.json --markdown /tmp/platform-workflow-lint.md` -> 0 findings - `python3 control-plane/platformctl/ci/check_docs_drift.py --root . --json /tmp/platform-docs-drift.json --markdown /tmp/platform-docs-drift.md` -> 0 findings - `pyfallow analyze --root control-plane --format agent-fix-plan --output /tmp/platform-p0-pyfallow-infisical-bridge.json --fail-on error --min-confidence medium` -> `blocking=0` ### Known constraints This PR does not install or authenticate Claude/Codex CLI on the runner. It makes readiness fail closed until that environment exists. ### Explicit out-of-scope - Adding provider keys to Forgejo repo secrets - Restarting or changing rs2000 runner service - Deploying to vps1000 - Changing canary reviewer providers - Posting Forgejo canary comments for real ### Requested decision Merge if the bridge contract is the right next step: no repo-level provider secrets, machine-local Infisical source, and honest readiness until CLI auth exists.

codex added 1 commit

2026-05-05 23:49:24 +02:00