pdurlej/platform

Fork 0

fix(ci): load automerge credentials from runner env #838

Merged

pdurlej merged 2 commits from codex/w6d-automerge-token-bridge into main

2026-06-26 10:13:16 +02:00

codex commented

2026-06-26 09:50:53 +02:00

Collaborator

Canary status: missing - fire canary 3+3 manually before merge

Canary Context Pack

Product story

W6d is supposed to let Patchwarden-approved platform PRs move without Piotr having to babysit every merge. The previous pilot reached readiness but could not execute because the merge token was not available to the workflow.

What changed

automerge-pilot now loads a runner-local PLATFORM_AUTOMERGE_ENV file on deploy-host during trusted workflow_dispatch runs.
The loader requires an absolute path and Infisical bridge metadata from write_canary_env.py.
Only PLATFORM_AUTOMERGE_READ_TOKEN and PLATFORM_AUTOMERGE_BOT_TOKEN are exported for later automerge steps.
The runner runbook now documents that automerge credentials must live outside the general pull-request canary env.

Why it changed

The runner had a valid-looking canary env path, but the W6d workflow expected PLATFORM_AUTOMERGE_BOT_TOKEN in its own job environment. Adding it to the general PR-sanity env would widen the trust boundary, because pull-request workflows source that file for model review/comments.

Files touched

.forgejo/workflows/automerge-pilot.yml
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
runbooks/forgejo-actions-runner.md

Relevant context

W6d autonomous merge pilot issue: #823
Smoke PR waiting on automerge credential path: #826
Runner-local Infisical bridge: write_canary_env.py

Runtime evidence

Local only in this PR. Prior read-only rs2000 audit found PLATFORM_AUTOMERGE_BOT_TOKEN missing from the runner env while FORGEJO_TOKEN_* values existed. Runtime regeneration is still required after merge.

Known constraints

Do not put PLATFORM_AUTOMERGE_BOT_TOKEN in PLATFORMCTL_CANARY_ENV.
Do not use Forgejo repository secrets for merge-bot credentials.
Do not execute merge from a pull_request workflow.

Explicit out-of-scope

Rotating or reading the merge-bot token value.
Regenerating rs2000 runtime env files.
Dispatching the final W6d merge run.

Requested decision

Approve this repo contract change, then regenerate PLATFORM_AUTOMERGE_ENV on rs2000 and rerun W6d against #826.

Merge blockers

Any path that exposes PLATFORM_AUTOMERGE_BOT_TOKEN to pull_request jobs.
Workflow syntax failure.
Contract tests failing.

Spec sources read

.forgejo/workflows/automerge-pilot.yml - W6d workflow contract.
control-plane/platformctl/ci/write_canary_env.py - runner env bridge metadata and rendering.
control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py - workflow contract tests.
runbooks/forgejo-actions-runner.md - runner/local env operating contract.
docs/ci/README.md and docs/ci/runner-contract.md - current CI env boundary references.

Verification

PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py -k 'automerge_pilot or write_canary_env'
PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py
git diff --check

Refs #823
Refs #826

Canary status: missing - fire canary 3+3 manually before merge ## Canary Context Pack ### Product story W6d is supposed to let Patchwarden-approved platform PRs move without Piotr having to babysit every merge. The previous pilot reached readiness but could not execute because the merge token was not available to the workflow. ### What changed - `automerge-pilot` now loads a runner-local `PLATFORM_AUTOMERGE_ENV` file on `deploy-host` during trusted `workflow_dispatch` runs. - The loader requires an absolute path and Infisical bridge metadata from `write_canary_env.py`. - Only `PLATFORM_AUTOMERGE_READ_TOKEN` and `PLATFORM_AUTOMERGE_BOT_TOKEN` are exported for later automerge steps. - The runner runbook now documents that automerge credentials must live outside the general pull-request canary env. ### Why it changed The runner had a valid-looking canary env path, but the W6d workflow expected `PLATFORM_AUTOMERGE_BOT_TOKEN` in its own job environment. Adding it to the general PR-sanity env would widen the trust boundary, because pull-request workflows source that file for model review/comments. ### Files touched - `.forgejo/workflows/automerge-pilot.yml` - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `runbooks/forgejo-actions-runner.md` ### Relevant context - W6d autonomous merge pilot issue: #823 - Smoke PR waiting on automerge credential path: #826 - Runner-local Infisical bridge: `write_canary_env.py` ### Runtime evidence Local only in this PR. Prior read-only rs2000 audit found `PLATFORM_AUTOMERGE_BOT_TOKEN` missing from the runner env while `FORGEJO_TOKEN_*` values existed. Runtime regeneration is still required after merge. ### Known constraints - Do not put `PLATFORM_AUTOMERGE_BOT_TOKEN` in `PLATFORMCTL_CANARY_ENV`. - Do not use Forgejo repository secrets for merge-bot credentials. - Do not execute merge from a pull_request workflow. ### Explicit out-of-scope - Rotating or reading the merge-bot token value. - Regenerating rs2000 runtime env files. - Dispatching the final W6d merge run. ### Requested decision Approve this repo contract change, then regenerate `PLATFORM_AUTOMERGE_ENV` on rs2000 and rerun W6d against #826. ### Merge blockers - Any path that exposes `PLATFORM_AUTOMERGE_BOT_TOKEN` to pull_request jobs. - Workflow syntax failure. - Contract tests failing. ## Spec sources read - `.forgejo/workflows/automerge-pilot.yml` - W6d workflow contract. - `control-plane/platformctl/ci/write_canary_env.py` - runner env bridge metadata and rendering. - `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - workflow contract tests. - `runbooks/forgejo-actions-runner.md` - runner/local env operating contract. - `docs/ci/README.md` and `docs/ci/runner-contract.md` - current CI env boundary references. ## Verification - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py -k 'automerge_pilot or write_canary_env'` - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `PYTHONPATH=control-plane python3 -m pytest control-plane/platformctl/tests/test_automerge_actor.py control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py` - `git diff --check` Refs #823 Refs #826

codex added 1 commit

2026-06-26 09:50:53 +02:00

fix(ci): load automerge credentials from runner env

infra-docs-drift / docs-drift (pull_request) Successful in 4s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 16s

Details

pyfallow / Pyfallow gate (control-plane) (pull_request) Successful in 15s

Details

python-ci / Python 3.11 (pull_request) Successful in 39s

Details

python-ci / Python 3.12 (pull_request) Successful in 41s

Details

python-ci / Python 3.13 (pull_request) Successful in 41s

Details

workflow-lint / lint (pull_request) Successful in 5s

Details

base-is-main / guard (pull_request) Successful in 1s

Details

patchwarden-client-dry-run / collect-diff (pull_request) Successful in 4s

Details

patchwarden-pr-sanity / collect-diff (pull_request) Successful in 4s

Details

canary-required / canary (pull_request) Successful in 15s

Details

canary-required / collect-diff (pull_request) Successful in 3s

Details

patchwarden-client-dry-run / dry-run (pull_request) Successful in 16s

Details

patchwarden-pr-sanity / sanity (pull_request) Successful in 42s

Details

3981be4644

codex added the

agent/codex

class/security-sensitive

labels

2026-06-26 09:51:16 +02:00

patchwarden commented

2026-06-26 09:59:43 +02:00

First-time contributor

Patchwarden PR sanity

Verdict: PASS WITH DEGRADED REVIEWER HEALTH - deterministic checks are clean, but this is not an approval signal.

Next step: Rerun PR sanity or inspect the degraded reviewer lane before unattended merge.

PR: 838
Commit: cd7b3fc4e92a889ee2c5082b037aabeba09e9a54
Status: eligible_sanity_clean
Reviewer health: degraded
Security-sensitive label: present
Authority: Patchwarden policy signal; branch protection and automerge controller remain merge authority.
Model mix: glm-5.2:cloud, deepseek-v4-pro:cloud, kimi-k2.7:cloud

What I checked

Changed files: 3
Deterministic blocker scan: clean
Model reviewer lanes: 3
Comment contract: this comment is updated in place via a hidden Patchwarden marker.

Approval Handoff

State: not_ready_degraded_reviewer_health
Action: rerun PR sanity or inspect the degraded reviewer lane before any unattended approval.
Boundary: branch protection and the automerge controller remain merge authority.

Required Fixes

No deterministic blockers.

Non-blocking Notes

info sensitive-path-touched Sensitive path touched - .forgejo/workflows/automerge-pilot.yml
- Evidence: .forgejo/workflows/automerge-pilot.yml
- Next: Route through the existing 3+3/risk-tier process; model review remains advisory.

Reviewer Details

Model reviewer lanes

`global-glm` / `glm-5.2:cloud`

Status: ok
Verdict: OK
medium Sourcing entire canary env file with set -a over-exposes secrets to load step
- Evidence: .forgejo/workflows/automerge-pilot.yml: set -a/. "$PLATFORM_AUTOMERGE_ENV"/set +a exports every variable in the generated file (including any FORGEJO_TOKEN_* values the PR description says coexist in canary env) into the shell pro
- Next: Parse only the two required keys from the file (e.g. via grep -E '^(PLATFORM_AUTOMERGE_READ_TOKEN|PLATFORM_AUTOMERGE_BOT_TOKEN)=' into a controlled subset, or have write_canary_env.py emit a dedicated automerge-only file) rather than sourcing the whole canary env.
low Heredoc delimiter collision risk in env file writer
- Evidence: .forgejo/workflows/automerge-pilot.yml: delimiter="PLATFORM_AUTOMERGE${name}_" uses a fixed, predictable string. If a token value ever contains that exact line, the Forgejo/GitHub env parser would truncate or corrupt it. Standard GITH
- Next: Generate a random delimiter per write (e.g. mktemp -u XXXXXXXX) and validate the value does not contain it before emitting.
low Contract test does not assert non-automerge secrets are excluded
- Evidence: control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py:218-232 asserts presence of expected strings in run but does not assert that FORGEJO_TOKEN_* or other canary-env keys are NOT forwarded to FORGEJO_ENV. The trust-boundary
- Next: Add a contract assertion that the run script only writes PLATFORM_AUTOMERGE_READ_TOKEN and PLATFORM_AUTOMERGE_BOT_TOKEN to env_out (e.g. grep that no other export_runner_env calls exist).

`global-deepseek` / `deepseek-v4-pro:cloud`

Status: ok
Verdict: OK
Findings: none

`redteam` / `kimi-k2.7:cloud`

Status: error
Verdict: -
Note: Ollama HTTP 404: {"error": "model 'kimi-k2.7:cloud' not found"}
Findings: none

Policy notes

Patchwarden PR sanity is the first merge-lane signal for this PR.
Models produce findings; Patchwarden/policy produces decisions.
Model findings alone do not fail the status check; they require human or agent disposition.
Formal approval is separate from this comment and requires clean reviewer health.
Automerge remains delegated to branch protection and the automerge pilot.

# Patchwarden PR sanity **Verdict:** PASS WITH DEGRADED REVIEWER HEALTH - deterministic checks are clean, but this is not an approval signal. **Next step:** Rerun PR sanity or inspect the degraded reviewer lane before unattended merge. - PR: `838` - Commit: `cd7b3fc4e92a889ee2c5082b037aabeba09e9a54` - Status: `eligible_sanity_clean` - Reviewer health: `degraded` - Security-sensitive label: `present` - Authority: Patchwarden policy signal; branch protection and automerge controller remain merge authority. - Model mix: `glm-5.2:cloud`, `deepseek-v4-pro:cloud`, `kimi-k2.7:cloud` ## What I checked - Changed files: `3` - Deterministic blocker scan: `clean` - Model reviewer lanes: `3` - Comment contract: this comment is updated in place via a hidden Patchwarden marker. ## Approval Handoff - State: `not_ready_degraded_reviewer_health` - Action: rerun PR sanity or inspect the degraded reviewer lane before any unattended approval. - Boundary: branch protection and the automerge controller remain merge authority. ## Required Fixes No deterministic blockers. ## Non-blocking Notes - **`info` `sensitive-path-touched`** Sensitive path touched - `.forgejo/workflows/automerge-pilot.yml` - Evidence: `.forgejo/workflows/automerge-pilot.yml` - Next: Route through the existing 3+3/risk-tier process; model review remains advisory. ## Reviewer Details <details> <summary>Model reviewer lanes</summary> ### `global-glm` / `glm-5.2:cloud` - Status: `ok` - Verdict: `OK` - **`medium`** Sourcing entire canary env file with `set -a` over-exposes secrets to load step - Evidence: `.forgejo/workflows/automerge-pilot.yml: `set -a` / `. "$PLATFORM_AUTOMERGE_ENV"` / `set +a` exports every variable in the generated file (including any FORGEJO_TOKEN_* values the PR description says coexist in canary env) into the shell pro` - Next: Parse only the two required keys from the file (e.g. via `grep -E '^(PLATFORM_AUTOMERGE_READ_TOKEN|PLATFORM_AUTOMERGE_BOT_TOKEN)='` into a controlled subset, or have write_canary_env.py emit a dedicated automerge-only file) rather than sourcing the whole canary env. - **`low`** Heredoc delimiter collision risk in env file writer - Evidence: `.forgejo/workflows/automerge-pilot.yml: `delimiter="__PLATFORM_AUTOMERGE_${name}__"` uses a fixed, predictable string. If a token value ever contains that exact line, the Forgejo/GitHub env parser would truncate or corrupt it. Standard GITH` - Next: Generate a random delimiter per write (e.g. `mktemp -u XXXXXXXX`) and validate the value does not contain it before emitting. - **`low`** Contract test does not assert non-automerge secrets are excluded - Evidence: `control-plane/platformctl/tests/test_forgejo_ci_scripts_contract.py:218-232 asserts presence of expected strings in `run` but does not assert that FORGEJO_TOKEN_* or other canary-env keys are NOT forwarded to FORGEJO_ENV. The trust-boundary` - Next: Add a contract assertion that the run script only writes PLATFORM_AUTOMERGE_READ_TOKEN and PLATFORM_AUTOMERGE_BOT_TOKEN to env_out (e.g. grep that no other `export_runner_env` calls exist). ### `global-deepseek` / `deepseek-v4-pro:cloud` - Status: `ok` - Verdict: `OK` - Findings: none ### `redteam` / `kimi-k2.7:cloud` - Status: `error` - Verdict: `-` - Note: Ollama HTTP 404: {"error": "model 'kimi-k2.7:cloud' not found"} - Findings: none </details> ## Policy notes - Patchwarden PR sanity is the first merge-lane signal for this PR. - Models produce findings; Patchwarden/policy produces decisions. - Model findings alone do not fail the status check; they require human or agent disposition. - Formal approval is separate from this comment and requires clean reviewer health. - Automerge remains delegated to branch protection and the automerge pilot.

codex added 1 commit

2026-06-26 10:03:47 +02:00

test(ci): pin automerge dispatch boundary

base-is-main / guard (pull_request) Successful in 1s

Details

platformctl plan / auto-apply scope (pull_request) Successful in 16s

Details

python-ci / Python 3.11 (pull_request) Successful in 39s

Details

python-ci / Python 3.12 (pull_request) Successful in 40s

Details

python-ci / Python 3.13 (pull_request) Successful in 41s