fix(ci): make patchwarden comment identity explicit #721

Merged

pdurlej merged 1 commit from codex/issues/711-patchwarden-guard-resolution into main

2026-06-05 01:41:26 +02:00

codex commented

2026-06-05 01:39:26 +02:00

Collaborator

Summary

makes Patchwarden PR comments use explicit actor tokens: FORGEJO_TOKEN_PATCHWARDEN first, then FORGEJO_TOKEN_CODEX, then legacy generic token only with explicit actor
adds a metadata-only --patchwarden-readiness verifier that suppresses secret values, lengths, prefixes, suffixes, and fingerprints
records the guard resolution: Patchwarden is a bot/safety actor, not a human-login account

Scope

Code/docs only. No Infisical writes, no runner env changes, no token rotation, no credential recovery.

Tests

python3 -m pytest control-plane/platformctl/tests/test_pr_sanity.py tests/test_secret_recovery_verify.py
python3 -m ruff check control-plane/platformctl/ci/pr_sanity.py control-plane/platformctl/tests/test_pr_sanity.py scripts/security/secret_recovery_verify.py tests/test_secret_recovery_verify.py

Smoke

python3 scripts/security/secret_recovery_verify.py --repo-root . --patchwarden-readiness --format json
python3 scripts/security/secret_recovery_verify.py --repo-root . --infisical --infisical-token-file "$HOME/.platformctl-runtime/infisical/claude-client-secret" --recovery-secret-key codex-kan-secret-recovery-2026-06-04 --identity-checks --runtime-host rs2000 --patchwarden-readiness --format json

Observed current state: secret present, identity check returns identity_error with HTTP 403, runtime Docker consumers empty. No secret values or lengths emitted.

Rollback

Revert this PR. That restores the previous comment-token fallback behavior and removes the dedicated Patchwarden readiness report.

Owner gates

Credential recovery remains gated. This PR does not generate, rotate, revoke, store, or map a Patchwarden PAT.

Refs #711

## Summary - makes Patchwarden PR comments use explicit actor tokens: `FORGEJO_TOKEN_PATCHWARDEN` first, then `FORGEJO_TOKEN_CODEX`, then legacy generic token only with explicit actor - adds a metadata-only `--patchwarden-readiness` verifier that suppresses secret values, lengths, prefixes, suffixes, and fingerprints - records the guard resolution: Patchwarden is a bot/safety actor, not a human-login account ## Scope Code/docs only. No Infisical writes, no runner env changes, no token rotation, no credential recovery. ## Tests ```bash python3 -m pytest control-plane/platformctl/tests/test_pr_sanity.py tests/test_secret_recovery_verify.py python3 -m ruff check control-plane/platformctl/ci/pr_sanity.py control-plane/platformctl/tests/test_pr_sanity.py scripts/security/secret_recovery_verify.py tests/test_secret_recovery_verify.py ``` ## Smoke ```bash python3 scripts/security/secret_recovery_verify.py --repo-root . --patchwarden-readiness --format json python3 scripts/security/secret_recovery_verify.py --repo-root . --infisical --infisical-token-file "$HOME/.platformctl-runtime/infisical/claude-client-secret" --recovery-secret-key codex-kan-secret-recovery-2026-06-04 --identity-checks --runtime-host rs2000 --patchwarden-readiness --format json ``` Observed current state: secret present, identity check returns `identity_error` with HTTP 403, runtime Docker consumers empty. No secret values or lengths emitted. ## Rollback Revert this PR. That restores the previous comment-token fallback behavior and removes the dedicated Patchwarden readiness report. ## Owner gates Credential recovery remains gated. This PR does not generate, rotate, revoke, store, or map a Patchwarden PAT. Refs #711

codex added 1 commit

2026-06-05 01:39:26 +02:00

fix(ci): make patchwarden comment identity explicit

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 19s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

canary-required / collect-diff (pull_request) Successful in 5s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 5s