pdurlej/platform

Fork 0

fix(ci): load automerge credentials from runner env #837

Closed

ollama wants to merge 0 commits from codex/w6d-automerge-token-bridge into main

ollama commented

2026-06-26 09:49:24 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Canary Context Pack

Product story

W6d is supposed to let Patchwarden-approved platform PRs move without Piotr having to babysit every merge. The previous pilot reached readiness but could not execute because the merge token was not available to the workflow.

What changed

automerge-pilot now loads a runner-local PLATFORM_AUTOMERGE_ENV file on deploy-host during trusted workflow_dispatch runs.
The loader requires an absolute path and Infisical bridge metadata from write_canary_env.py.
Only PLATFORM_AUTOMERGE_READ_TOKEN and PLATFORM_AUTOMERGE_BOT_TOKEN are exported for later automerge steps.
The runner runbook now documents that automerge credentials must live outside the general pull-request canary env.

Why it changed

The runner had a valid-looking canary env path, but the W6d workflow expected PLATFORM_AUTOMERGE_BOT_TOKEN in its own job environment. Adding it to the general PR-sanity env would widen the trust boundary, because pull-request workflows source that file for model review/comments.

Files touched

.forgejo/workflows/automerge-pilot.yml
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
runbooks/forgejo-actions-runner.md

Relevant context

W6d autonomous merge pilot issue: #823
Smoke PR waiting on automerge credential path: #826
Runner-local Infisical bridge: write_canary_env.py

Runtime evidence

Local only in this PR. Prior read-only rs2000 audit found PLATFORM_AUTOMERGE_BOT_TOKEN missing from the runner env while FORGEJO_TOKEN_* values existed. Runtime regeneration is still required after merge.

Known constraints

Do not put PLATFORM_AUTOMERGE_BOT_TOKEN in PLATFORMCTL_CANARY_ENV.
Do not use Forgejo repository secrets for merge-bot credentials.
Do not execute merge from a pull_request workflow.

Explicit out-of-scope

Rotating or reading the merge-bot token value.
Regenerating rs2000 runtime env files.
Dispatching the final W6d merge run.

Requested decision

Approve this repo contract change, then regenerate PLATFORM_AUTOMERGE_ENV on rs2000 and rerun W6d against #826.

Merge blockers

Any path that exposes PLATFORM_AUTOMERGE_BOT_TOKEN to pull_request jobs.
Workflow syntax failure.
Contract tests failing.

Spec sources read

.forgejo/workflows/automerge-pilot.yml - W6d workflow contract.
control-plane/platformctl/ci/write_canary_env.py - runner env bridge metadata and rendering.
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py - workflow contract tests.
runbooks/forgejo-actions-runner.md - runner/local env operating contract.
docs/ci/README.md and docs/ci/runner-contract.md - current CI env boundary references.

Verification

PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py -k 'automerge_pilot or write_canary_env'
PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
git diff --check

Refs #823
Refs #826

Canary status: missing - fire canary 3+3 manually before merge ## Canary Context Pack ### Product story W6d is supposed to let Patchwarden-approved platform PRs move without Piotr having to babysit every merge. The previous pilot reached readiness but could not execute because the merge token was not available to the workflow. ### What changed - `automerge-pilot` now loads a runner-local `PLATFORM_AUTOMERGE_ENV` file on `deploy-host` during trusted `workflow_dispatch` runs. - The loader requires an absolute path and Infisical bridge metadata from `write_canary_env.py`. - Only `PLATFORM_AUTOMERGE_READ_TOKEN` and `PLATFORM_AUTOMERGE_BOT_TOKEN` are exported for later automerge steps. - The runner runbook now documents that automerge credentials must live outside the general pull-request canary env. ### Why it changed The runner had a valid-looking canary env path, but the W6d workflow expected `PLATFORM_AUTOMERGE_BOT_TOKEN` in its own job environment. Adding it to the general PR-sanity env would widen the trust boundary, because pull-request workflows source that file for model review/comments. ### Files touched - `.forgejo/workflows/automerge-pilot.yml` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `runbooks/forgejo-actions-runner.md` ### Relevant context - W6d autonomous merge pilot issue: #823 - Smoke PR waiting on automerge credential path: #826 - Runner-local Infisical bridge: `write_canary_env.py` ### Runtime evidence Local only in this PR. Prior read-only rs2000 audit found `PLATFORM_AUTOMERGE_BOT_TOKEN` missing from the runner env while `FORGEJO_TOKEN_*` values existed. Runtime regeneration is still required after merge. ### Known constraints - Do not put `PLATFORM_AUTOMERGE_BOT_TOKEN` in `PLATFORMCTL_CANARY_ENV`. - Do not use Forgejo repository secrets for merge-bot credentials. - Do not execute merge from a pull_request workflow. ### Explicit out-of-scope - Rotating or reading the merge-bot token value. - Regenerating rs2000 runtime env files. - Dispatching the final W6d merge run. ### Requested decision Approve this repo contract change, then regenerate `PLATFORM_AUTOMERGE_ENV` on rs2000 and rerun W6d against #826. ### Merge blockers - Any path that exposes `PLATFORM_AUTOMERGE_BOT_TOKEN` to pull_request jobs. - Workflow syntax failure. - Contract tests failing. ## Spec sources read - `.forgejo/workflows/automerge-pilot.yml` - W6d workflow contract. - `control-plane/platformctl/ci/write_canary_env.py` - runner env bridge metadata and rendering. - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - workflow contract tests. - `runbooks/forgejo-actions-runner.md` - runner/local env operating contract. - `docs/ci/README.md` and `docs/ci/runner-contract.md` - current CI env boundary references. ## Verification - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py -k 'automerge_pilot or write_canary_env'` - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `git diff --check` Refs #823 Refs #826

ollama added 1 commit

2026-06-26 09:49:24 +02:00

fix(ci): load automerge credentials from runner env

platformctl plan / auto-apply scope (pull_request) Successful in 16s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 15s

Details

python-ci / Python 3.12 (pull_request) Successful in 41s

Details

python-ci / Python 3.13 (pull_request) Successful in 41s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

python-ci / Python 3.11 (pull_request) Successful in 39s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 42s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Successful in 15s

Details

canary-required / collect-diff (pull_request) Successful in 3s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 16s

Details

3981be4644

codex commented

2026-06-26 09:50:51 +02:00

Collaborator

Superseded: this PR was opened with the wrong local Forgejo credential (ollama) from the Codex workstation. Recreating with the codex actor for audit-trail correctness.

Superseded: this PR was opened with the wrong local Forgejo credential (`ollama`) from the Codex workstation. Recreating with the `codex` actor for audit-trail correctness.

codex closed this pull request

2026-06-26 09:50:52 +02:00

patchwarden commented

2026-06-26 09:58:19 +02:00

First-time contributor

Patchwarden PR sanity

Verdict: BLOCKED - deterministic blocker found.

Next step: Fix the deterministic blocker(s), push a new head, and rerun PR sanity.

PR: 837
Commit: 3981be464493fb1a62408a5ab65488220c546383
Status: blocked
Reviewer health: degraded
Security-sensitive label: missing
Authority: Patchwarden policy signal; branch protection and automerge controller remain merge authority.
Model mix: glm-5.2:cloud, deepseek-v4-pro:cloud, kimi-k2.7:cloud

What I checked

Changed files: 3
Deterministic blocker scan: blocked
Model reviewer lanes: 3
Comment contract: this comment is updated in place via a hidden Patchwarden marker.

Approval Handoff

State: not_ready_deterministic_blocker
Action: fix deterministic blocker(s), push a new head, and rerun PR sanity before approval.
Boundary: branch protection and the automerge controller remain merge authority.

Required Fixes

blocker security-sensitive-label-missing Security-sensitive change missing class/security-sensitive label - .forgejo/workflows/automerge-pilot.yml
- Evidence: .forgejo/workflows/automerge-pilot.yml
- Next: Apply class/security-sensitive and route through the full security-sensitive review lane before merge.

Non-blocking Notes

info sensitive-path-touched Sensitive path touched - .forgejo/workflows/automerge-pilot.yml
- Evidence: .forgejo/workflows/automerge-pilot.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Reviewer Details

Model reviewer lanes

`global-glm` / `glm-5.2:cloud`

Status: ok
Verdict: OK
low Sourcing entire env file widens in-step trust surface beyond the two intended tokens
- Evidence: .forgejo/workflows/automerge-pilot.yml: set -a/. "$PLATFORM_AUTOMERGE_ENV"/set +aimports every variable in the file into the step's process environment, then onlyPLATFORM_AUTOMERGE_READ_TOKENandPLATFORM_AUTOMERGE_BOT_TOKEN``
- Next: Either document that PLATFORM_AUTOMERGE_ENV must contain only the two automerge tokens, or grep/extract just those two names from the file instead of sourcing it wholesale.
low Silent no-op when PLATFORM_AUTOMERGE_ENV unset may mask misconfiguration on trusted dispatch
- Evidence: .forgejo/workflows/automerge-pilot.yml: if [ -z "${PLATFORM_AUTOMERGE_ENV:-}" ]; then echo "::notice::..."; exit 0; fi continues readiness without the bot token, deferring failure to downstream automerge steps where the root cause is less
- Next: Consider emitting a workflow-level warning or setting a step output flag so downstream steps can fail fast with a clear message when the bot token was never loaded.

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.7:cloud`

Status: error
Verdict: -
Note: Ollama HTTP 404: {"error": "model 'kimi-k2.7:cloud' not found"}
Findings: none

Policy notes

Patchwarden PR sanity is the first merge-lane signal for this PR.
Models produce findings; Patchwarden/policy produces decisions.
Model findings alone do not fail the status check; they require human or agent disposition.
Formal approval is separate from this comment and requires clean reviewer health.
Automerge remains delegated to branch protection and the automerge pilot.

# Patchwarden PR sanity **Verdict:** BLOCKED - deterministic blocker found. **Next step:** Fix the deterministic blocker(s), push a new head, and rerun PR sanity. - PR: `837` - Commit: `3981be464493fb1a62408a5ab65488220c546383` - Status: `blocked` - Reviewer health: `degraded` - Security-sensitive label: `missing` - Authority: Patchwarden policy signal; branch protection and automerge controller remain merge authority. - Model mix: `glm-5.2:cloud`, `deepseek-v4-pro:cloud`, `kimi-k2.7:cloud` ## What I checked - Changed files: `3` - Deterministic blocker scan: `blocked` - Model reviewer lanes: `3` - Comment contract: this comment is updated in place via a hidden Patchwarden marker. ## Approval Handoff - State: `not_ready_deterministic_blocker` - Action: fix deterministic blocker(s), push a new head, and rerun PR sanity before approval. - Boundary: branch protection and the automerge controller remain merge authority. ## Required Fixes - **`blocker` `security-sensitive-label-missing`** Security-sensitive change missing class/security-sensitive label - `.forgejo/workflows/automerge-pilot.yml` - Evidence: `.forgejo/workflows/automerge-pilot.yml` - Next: Apply `class/security-sensitive` and route through the full security-sensitive review lane before merge. ## Non-blocking Notes - **`info` `sensitive-path-touched`** Sensitive path touched - `.forgejo/workflows/automerge-pilot.yml` - Evidence: `.forgejo/workflows/automerge-pilot.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Reviewer Details <details> <summary>Model reviewer lanes</summary> ### `global-glm` / `glm-5.2:cloud` - Status: `ok` - Verdict: `OK` - **`low`** Sourcing entire env file widens in-step trust surface beyond the two intended tokens - Evidence: `.forgejo/workflows/automerge-pilot.yml: `set -a` / `. "$PLATFORM_AUTOMERGE_ENV"` / `set +a` imports every variable in the file into the step's process environment, then only `PLATFORM_AUTOMERGE_READ_TOKEN` and `PLATFORM_AUTOMERGE_BOT_TOKEN`` - Next: Either document that PLATFORM_AUTOMERGE_ENV must contain only the two automerge tokens, or grep/extract just those two names from the file instead of sourcing it wholesale. - **`low`** Silent no-op when PLATFORM_AUTOMERGE_ENV unset may mask misconfiguration on trusted dispatch - Evidence: `.forgejo/workflows/automerge-pilot.yml: `if [ -z "${PLATFORM_AUTOMERGE_ENV:-}" ]; then echo "::notice::..."; exit 0; fi` continues readiness without the bot token, deferring failure to downstream automerge steps where the root cause is less` - Next: Consider emitting a workflow-level warning or setting a step output flag so downstream steps can fail fast with a clear message when the bot token was never loaded. ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.7:cloud` - Status: `error` - Verdict: `-` - Note: Ollama HTTP 404: {"error": "model 'kimi-k2.7:cloud' not found"} - Findings: none </details> ## Policy notes - Patchwarden PR sanity is the first merge-lane signal for this PR. - Models produce findings; Patchwarden/policy produces decisions. - Model findings alone do not fail the status check; they require human or agent disposition. - Formal approval is separate from this comment and requires clean reviewer health. - Automerge remains delegated to branch protection and the automerge pilot.