fix(platformctl): prefer Infisical token auth before direct PAT #273

Merged

pdurlej merged 1 commit from codex/issues/272-infisical-first-token-resolution into main

2026-05-14 09:30:26 +02:00

codex commented

2026-05-14 09:20:10 +02:00

Collaborator

Canary status: missing - class/security-sensitive; operator merge only after review.

Canary Context Pack

Product story

The deploy runner needs a 7-day soak where Infisical Token Auth is exercised while the old direct Forgejo PAT remains available as a fallback. The current resolver makes that impossible because it silently chooses the direct PAT first.

What changed

platformctl apply now prefers PLATFORMCTL_INFISICAL_TOKEN_AUTH_FILE over direct PAT env vars when both are configured.
Added non-secret log markers for token source:
- forgejo_token_source=infisical-token-auth
- forgejo_token_source=direct-env-fallback
- forgejo_token_source=explicit-argument
Updated the runner install script so it preserves direct PAT during the soak instead of removing it immediately.
Added tests for Infisical-over-direct precedence and direct fallback logging.

Why it changed

During the Infisical Token Auth close-out dispatch on 2026-05-14, audit found that a green matrix-well-known smoke would have been misleading: direct PAT was still present, and apply.py would never call Infisical.

Files touched

control-plane/platformctl/apply.py
control-plane/platformctl/tests/test_apply_phase3.py
scripts/forgejo/deploy-runner-install-infisical-token-auth

Relevant context

#265 — Infisical Token Auth migration thread
#272 — blocker issue for silent direct PAT bypass
#142 — RS2000 cutover lane

Runtime evidence

No smoke and no production apply were run from this PR.

Runner-local setup evidence from #142 comment 5225:

token file installed on RS2000, mode 0600, owner forgejo-deploy:forgejo-deploy, size 333 bytes
runner active
direct PAT preserved for soak
public https://infisical.pdurlej.com returns 403 from RS2000, but local Infisical container endpoint returns HTTP 200 for the same token

Test output

uv run pytest platformctl/tests/test_apply_phase3.py -q
# 46 passed in 1.43s

uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py -q
# 25 passed in 1.24s

bash -n scripts/forgejo/deploy-runner-install-infisical-token-auth
git diff --check

Known constraints

This PR does not remove the direct PAT. That is deliberate; direct PAT removal is after the 7-day soak.
forgejo_token_source=* markers are intentionally logged as warnings so they appear in workflow stderr without extra logging configuration. They contain no secrets.
The runner currently uses an internal Infisical endpoint because the public edge returns 403 from RS2000.

Explicit out-of-scope

No direct PAT removal.
No F3 smoke.
No real-change apply.
No Infisical ACL/UI changes.
No /etc/hosts or Traefik changes.

Requested decision

Merge this before retrying the Infisical close-out matrix-well-known smoke. Without this PR, the smoke cannot prove Infisical resolution.

Merge blockers

Any token value in logs.
Any code path that removes direct PAT before soak ends.
Missing proof that Infisical wins over direct PAT when both are configured.

Spec sources read

control-plane/platformctl/apply.py — token resolution implementation.
control-plane/platformctl/tests/test_apply_phase3.py — approval/token tests.
scripts/forgejo/deploy-runner-install-infisical-token-auth — runner install behavior.
.forgejo/workflows/platformctl-auto-apply.yml — workflow logging/artifact context.

Closes #272

Canary status: missing - class/security-sensitive; operator merge only after review. ## Canary Context Pack ### Product story The deploy runner needs a 7-day soak where Infisical Token Auth is exercised while the old direct Forgejo PAT remains available as a fallback. The current resolver makes that impossible because it silently chooses the direct PAT first. ### What changed - `platformctl apply` now prefers `PLATFORMCTL_INFISICAL_TOKEN_AUTH_FILE` over direct PAT env vars when both are configured. - Added non-secret log markers for token source: - `forgejo_token_source=infisical-token-auth` - `forgejo_token_source=direct-env-fallback` - `forgejo_token_source=explicit-argument` - Updated the runner install script so it preserves direct PAT during the soak instead of removing it immediately. - Added tests for Infisical-over-direct precedence and direct fallback logging. ### Why it changed During the Infisical Token Auth close-out dispatch on 2026-05-14, audit found that a green `matrix-well-known` smoke would have been misleading: direct PAT was still present, and `apply.py` would never call Infisical. ### Files touched - `control-plane/platformctl/apply.py` - `control-plane/platformctl/tests/test_apply_phase3.py` - `scripts/forgejo/deploy-runner-install-infisical-token-auth` ### Relevant context - #265 — Infisical Token Auth migration thread - #272 — blocker issue for silent direct PAT bypass - #142 — RS2000 cutover lane ### Runtime evidence No smoke and no production apply were run from this PR. Runner-local setup evidence from #142 comment 5225: - token file installed on RS2000, mode `0600`, owner `forgejo-deploy:forgejo-deploy`, size `333 bytes` - runner active - direct PAT preserved for soak - public `https://infisical.pdurlej.com` returns 403 from RS2000, but local Infisical container endpoint returns HTTP 200 for the same token ### Test output ```bash uv run pytest platformctl/tests/test_apply_phase3.py -q # 46 passed in 1.43s uv run pytest platformctl/tests/test_forgejo_ci_scripts_contract.py -q # 25 passed in 1.24s bash -n scripts/forgejo/deploy-runner-install-infisical-token-auth git diff --check ``` ### Known constraints - This PR does not remove the direct PAT. That is deliberate; direct PAT removal is after the 7-day soak. - `forgejo_token_source=*` markers are intentionally logged as warnings so they appear in workflow stderr without extra logging configuration. They contain no secrets. - The runner currently uses an internal Infisical endpoint because the public edge returns 403 from RS2000. ### Explicit out-of-scope - No direct PAT removal. - No F3 smoke. - No real-change apply. - No Infisical ACL/UI changes. - No `/etc/hosts` or Traefik changes. ### Requested decision Merge this before retrying the Infisical close-out `matrix-well-known` smoke. Without this PR, the smoke cannot prove Infisical resolution. ### Merge blockers - Any token value in logs. - Any code path that removes direct PAT before soak ends. - Missing proof that Infisical wins over direct PAT when both are configured. ## Spec sources read - `control-plane/platformctl/apply.py` — token resolution implementation. - `control-plane/platformctl/tests/test_apply_phase3.py` — approval/token tests. - `scripts/forgejo/deploy-runner-install-infisical-token-auth` — runner install behavior. - `.forgejo/workflows/platformctl-auto-apply.yml` — workflow logging/artifact context. Closes #272

codex added 1 commit

2026-05-14 09:20:10 +02:00

fix(platformctl): prefer Infisical token auth before direct PAT

canary-required / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 21s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 19s

Details

python-ci / Python 3.11 (pull_request) Successful in 36s

Details

python-ci / Python 3.12 (pull_request) Successful in 36s