ci: ci+docs: real offline-licensed CI via a test-only aidn2 key (#15)#1915
Conversation
Documents the remaining operational half of the offline-license CI setup (the csproj embedding + CI injection + AIDOTNET_LICENSE_KEY wiring already ship): generating the CI Ed25519 keypair, minting a scoped short-exp CI token, and installing the secret — including the trust-scope decision (keep the CI key out of published packages vs. shipping it) and prod/CI key rotation steps. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Deployment failed with the following error: Learn More: https://vercel.com/franklins-projects-02a0b5a0?upgradeToPro=build-rate-limit |
|
Warning Review limit reachedYou’ve reached a temporary PR review limit under our Fair Usage Limits Policy. Next review available in: 37 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (5)
WalkthroughAdds documentation for the ChangesOffline License Documentation
Estimated code review effort: 1 (Trivial) | ~5 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tools/license-issuer/README.md`:
- Around line 15-17: Update the token grammar code fence in the README to
include an explicit language tag, preferably text, after the opening fence while
preserving the existing token format.
- Around line 49-68: Update the license-issuer README setup and rotation
instructions around keygen.py, aidn2_issuer.py, the JWK merge, and install
commands so every command is directly copy-pasteable. Document or use supported
output options to create ci_private.pem and ci_token.txt, replace literal
placeholder values with concrete paths or explicit copy steps, and ensure the
documented filenames match what the install and rotation scripts consume.
- Around line 112-115: Update the “Simpler, weaker — CI key ships” section to
remove the claim that the CI key is intrinsically scoped or short-lived. Either
remove this alternative entirely or explicitly state that embedding ci-2026a
grants full package trust to anyone holding its private key until emergency key
rotation, and that token claims and issuer policy alone provide scope and
expiration.
- Around line 87-96: The api function currently parses every response as JSON,
but the secret update PUT may return 204 No Content. Update api to inspect the
response status and return early for HTTP 204 before calling json.load, while
preserving JSON parsing for responses with content.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: ASSERTIVE
Plan: Pro
Run ID: e61dada1-4299-483c-aa97-40fbb8b1d296
📒 Files selected for processing (1)
tools/license-issuer/README.md
…ffline path Wires the CI test builds to embed a TEST-only public key set (prod + ci-2026a) via the new AIDOTNET_LICENSE_PUBLIC_KEY_JSON_TEST variable, so the offline aidn2 CI token in the AIDOTNET_LICENSE_KEY secret verifies on the real AsymmetricLicenseVerifier path (the ModuleInitializer keeps an offline-Active, model:save-capable key; else it falls back to the synthetic license, so this is non-breaking either way). The CI key is deliberately kept OUT of AIDOTNET_LICENSE_PUBLIC_KEY_JSON (used by release-please.yml), so published NuGets trust ONLY the production key — a leaked CI key can never mint a license accepted by a shipped package. - sonarcloud.yml: prefer the _TEST key set in the existing inject step. - heavy-timeout-nightly.yml: add the inject step before build (it had none). See tools/license-issuer/README.md for key generation + rotation. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
ooples
changed the title
|
🤖 PR Title Auto-Fixed Your PR title was automatically updated to follow Conventional Commits format. Original title: New title: Detected type: Valid types and their effects:
If the detected type is incorrect, you can manually edit the PR title. |
github-actions
Bot
changed the title
Commit messages auto-fixedOne or more commit messages did not follow Conventional Commits, so they were rewritten to comply (subject case, header length ≤ 100, valid type). Each commit and its diff were preserved — no squashing. The branch was force-pushed with the corrected messages. If you have local work on this branch, run |
0ce7101 to
f42352b
Compare
2 participants
Completes task #15 — durable, real offline-licensed CI on a separate, test-only aidn2 key that never ships in published packages.
Already shipped in #1891 (verified, not rebuilt)
BuildKey/LicensePublicKey.json;LicensePublicKeyProvidersupports multi-kid rotation.keygen.py/aidn2_issuer.pytooling.ModuleInitializerkeeps an offline-Active,model:save-capableAIDOTNET_LICENSE_KEY(the CI aidn2 path) and otherwise installs a synthetic offline license — so this change is non-breaking either way.This PR
tools/license-issuer/README.md— issuance + rotation guide, incl. the trust-scope rationale.sonarcloud.yml/heavy-timeout-nightly.yml— inject a test-only merged key set (prod +ci-2026a) via the newAIDOTNET_LICENSE_PUBLIC_KEY_JSON_TESTvariable, so CI builds verify the CI token on the realAsymmetricLicenseVerifierpath. release-please.yml is untouched → published NuGets trust production only.Installed out-of-band (repo settings, not in this diff)
ci-2026aEd25519 keypair; minted a scoped 30-day token (caps: model/tensors save+load, model:encrypt; no scope/machine binding). Signature verified against the CI public key.AIDOTNET_LICENSE_PUBLIC_KEY_JSON_TEST= merged prod+ci JWK.AIDOTNET_LICENSE_KEY= the aidn2 CI token.Generated with Claude Code