ci: reduce release-shared secret exposure

leeroybrun · leeroybrun · commit 9d262a658a3d · 2026-02-13T09:11:59.000+01:00
Stop granting release-shared env secrets to release actor guard + release checks jobs.\n\nGuard now falls back to repo-admin authorization when app credentials are not provided, and contract tests are updated to match.
diff --git a/.github/actions/release-actor-guard/action.yml b/.github/actions/release-actor-guard/action.yml
@@ -11,11 +11,13 @@ inputs:
     required: false
     default: ""
   app_id:
-    description: GitHub App ID used to check team membership
-    required: true
+    description: GitHub App ID used to check team membership (optional; when omitted, guard falls back to repo-admin check)
+    required: false
+    default: ""
   private_key:
-    description: GitHub App private key used to check team membership
-    required: true
+    description: GitHub App private key used to check team membership (optional; when omitted, guard falls back to repo-admin check)
+    required: false
+    default: ""
 
 runs:
   using: composite
@@ -51,6 +53,7 @@ runs:
     - name: Create GitHub App token for guard checks
       id: app_token
       uses: actions/create-github-app-token@v1
+      if: ${{ inputs.app_id != '' && inputs.private_key != '' }}
       with:
         app-id: ${{ inputs.app_id }}
         private-key: ${{ inputs.private_key }}
@@ -68,11 +71,6 @@ runs:
       run: |
         set -euo pipefail
 
-        if [ -z "${APP_TOKEN:-}" ]; then
-          echo "Missing GitHub App token for release actor guard." >&2
-          exit 1
-        fi
-
         fallback_repo_admin() {
           if [ -z "${REPO_TOKEN:-}" ]; then
             echo "Missing repo token for release actor guard fallback." >&2
@@ -112,6 +110,12 @@ runs:
           echo "Actor '${ACTOR}' is a repo admin; allowing release workflow."
         }
 
+        if [ -z "${APP_TOKEN:-}" ]; then
+          echo "No GitHub App credentials provided; authorizing via repo-admin check."
+          fallback_repo_admin
+          exit 0
+        fi
+
         endpoint="https://api.github.com/orgs/${ORG}/teams/${TEAM_SLUG}/memberships/${ACTOR}"
         resp_file="$(mktemp)"
         status="$(curl -sS \
diff --git a/.github/workflows/build-tauri.yml b/.github/workflows/build-tauri.yml
@@ -55,16 +55,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Authorize release actor
         uses: ./.github/actions/release-actor-guard
         with:
           team_slug: release-admins
-          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
   resolve_source:
     name: Resolve source ref to SHA
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -65,16 +65,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Authorize release actor
         uses: ./.github/actions/release-actor-guard
         with:
           team_slug: release-admins
-          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
   deploy:
     needs: [release_actor_guard]
diff --git a/.github/workflows/promote-branch.yml b/.github/workflows/promote-branch.yml
@@ -77,16 +77,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Authorize release actor
         uses: ./.github/actions/release-actor-guard
         with:
           team_slug: release-admins
-          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
   promote:
     needs: [release_actor_guard]
diff --git a/.github/workflows/promote-docs.yml b/.github/workflows/promote-docs.yml
@@ -70,16 +70,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Authorize release actor
         uses: ./.github/actions/release-actor-guard
         with:
           team_slug: release-admins
-          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
   promote:
     needs: [release_actor_guard]
diff --git a/.github/workflows/promote-server.yml b/.github/workflows/promote-server.yml
@@ -85,16 +85,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Authorize release actor
         uses: ./.github/actions/release-actor-guard
         with:
           team_slug: release-admins
-          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
   promote:
     needs: [release_actor_guard]
diff --git a/.github/workflows/promote-ui.yml b/.github/workflows/promote-ui.yml
@@ -160,16 +160,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Authorize release actor
         uses: ./.github/actions/release-actor-guard
         with:
           team_slug: release-admins
-          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
   promote:
     needs: [release_actor_guard]
diff --git a/.github/workflows/promote-website.yml b/.github/workflows/promote-website.yml
@@ -85,16 +85,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Authorize release actor
         uses: ./.github/actions/release-actor-guard
         with:
           team_slug: release-admins
-          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
   promote:
     needs: [release_actor_guard]
diff --git a/.github/workflows/providers-contracts.yml b/.github/workflows/providers-contracts.yml
@@ -83,16 +83,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Authorize release actor
         uses: ./.github/actions/release-actor-guard
         with:
           team_slug: release-admins
-          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
   trusted_ref_guard:
     needs: [release_actor_guard]
diff --git a/.github/workflows/publish-github-release.yml b/.github/workflows/publish-github-release.yml
@@ -59,16 +59,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Authorize release actor
         uses: ./.github/actions/release-actor-guard
         with:
           team_slug: release-admins
-          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
   publish:
     needs: [release_actor_guard]
diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml
@@ -93,16 +93,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Authorize release actor
         uses: ./.github/actions/release-actor-guard
         with:
           team_slug: release-admins
-          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
   release:
     needs: [release_actor_guard]
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -168,7 +168,6 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -221,7 +220,6 @@ jobs:
     needs: [release_actor_guard, gate, providers_gate]
     if: ${{ always() && needs.release_actor_guard.result == 'success' && (needs.gate.result == 'success' || needs.gate.result == 'skipped') && (needs.providers_gate.result == 'success' || needs.providers_gate.result == 'skipped') }}
     runs-on: ubuntu-latest
-    environment: release-shared
     outputs:
       changed_ui: ${{ steps.plan.outputs.changed_ui }}
       changed_cli: ${{ steps.plan.outputs.changed_cli }}
@@ -295,19 +293,11 @@ jobs:
               ;;
           esac
 
-      - name: Create GitHub App token
-        id: app_token
-        uses: actions/create-github-app-token@v1
-        with:
-          app-id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private-key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
-
       - name: Checkout dev
         uses: actions/checkout@v4
         with:
           ref: dev
           fetch-depth: 0
-          token: ${{ steps.app_token.outputs.token }}
 
       - name: Setup Node
         uses: actions/setup-node@v4
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
@@ -1179,16 +1179,13 @@ jobs:
     permissions:
       contents: read
     runs-on: ubuntu-latest
-    environment: release-shared
     steps:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Authorize release actor
         uses: ./.github/actions/release-actor-guard
         with:
           team_slug: release-admins
-          app_id: ${{ secrets.RELEASE_BOT_APP_ID }}
-          private_key: ${{ secrets.RELEASE_BOT_PRIVATE_KEY }}
 
   providers:
     needs: [release_actor_guard]
diff --git a/scripts/release/workflow_secret_hardening.contract.test.mjs b/scripts/release/workflow_secret_hardening.contract.test.mjs
@@ -23,7 +23,6 @@ test('release workflows scope shared signing/publishing secrets to release-share
     ['promote-branch.yml', 'promote', 'release-shared'],
     ['build-tauri.yml', 'build', 'release-shared'],
     ['publish-github-release.yml', 'publish', 'release-shared'],
-    ['release.yml', 'checks', 'release-shared'],
     ['release.yml', 'deploy_plan', 'release-shared'],
   ];
 
@@ -118,13 +117,18 @@ test('secret-bearing workflows require release-admin actor guard before privileg
   assert.match(
     guardRaw,
     /actions\/create-github-app-token@v1/,
-    'release-actor-guard should create a GitHub App token for team membership checks'
+    'release-actor-guard should support GitHub App token checks for team membership'
   );
   assert.match(
     guardRaw,
     /orgs\/\$\{ORG\}\/teams\/\$\{TEAM_SLUG\}\/memberships\/\$\{ACTOR\}/,
     'release-actor-guard should verify actor membership in the configured team via the GitHub API'
   );
+  assert.match(
+    guardRaw,
+    /collaborators\/\$\{ACTOR\}\/permission/,
+    'release-actor-guard should support repo-admin fallback authorization checks'
+  );
   assert.match(
     guardRaw,
     /GITHUB_TRIGGERING_ACTOR/,
@@ -163,11 +167,40 @@ test('secret-bearing workflows require release-admin actor guard before privileg
     const { parsed } = await loadWorkflow(file);
     const guard = parsed?.jobs?.[guardJob];
     assert.ok(guard, `${file} should define '${guardJob}'`);
-    assert.equal(
-      guard?.uses,
-      './.github/workflows/release-actor-guard.yml',
-      `${file} should reuse release-actor-guard workflow`
-    );
+    if (guard?.uses) {
+      assert.equal(
+        guard?.uses,
+        './.github/workflows/release-actor-guard.yml',
+        `${file} should use the canonical release-actor-guard reusable workflow`
+      );
+    } else {
+      assert.equal(
+        guard?.environment,
+        undefined,
+        `${file} '${guardJob}' should not request release-shared environment secrets`
+      );
+      assert.ok(
+        Array.isArray(guard?.steps),
+        `${file} '${guardJob}' should be implemented as a normal job with steps`
+      );
+      const guardStep = guard.steps.find(
+        (step) => step?.uses === './.github/actions/release-actor-guard'
+      );
+      assert.ok(
+        guardStep,
+        `${file} '${guardJob}' should use the composite release-actor-guard action`
+      );
+      assert.equal(
+        guardStep?.with?.app_id,
+        undefined,
+        `${file} '${guardJob}' should not pass app_id secrets to the guard action`
+      );
+      assert.equal(
+        guardStep?.with?.private_key,
+        undefined,
+        `${file} '${guardJob}' should not pass private_key secrets to the guard action`
+      );
+    }
 
     const job = parsed?.jobs?.[jobName];
     assert.ok(job, `${file} should define job '${jobName}'`);
