Skip to content

Commit e51f223

Browse files
russell-sternrussell-stern
committed
Added vault audit workflows
1 parent c3f9f2a commit e51f223

3 files changed

Lines changed: 189 additions & 0 deletions

File tree

‎.github/workflows/vault-audit-commands.yml‎

Lines changed: 115 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
name: Vault Audit Commands
2+
3+
# Handles /vault-audit and /vault-audit skip <reason> comments from authorized reviewers.
4+
# Authorization: commenter must have write or admin permission on this repository
5+
# (which is the requirement for being listed in CODEOWNERS).
6+
7+
on:
8+
issue_comment:
9+
types: [created]
10+
11+
jobs:
12+
handle-command:
13+
# Only run on PR comments containing a vault-audit command
14+
if: |
15+
github.event.issue.pull_request != null &&
16+
(
17+
startsWith(github.event.comment.body, '/vault-audit skip ') ||
18+
github.event.comment.body == '/vault-audit' ||
19+
startsWith(github.event.comment.body, '/vault-audit ')
20+
)
21+
runs-on: ubuntu-latest
22+
permissions:
23+
issues: write
24+
pull-requests: write
25+
statuses: write
26+
27+
steps:
28+
- name: Check commenter authorization
29+
id: auth
30+
env:
31+
GH_TOKEN: ${{ github.token }}
32+
run: |
33+
PERMISSION=$(gh api /repos/${{ github.repository }}/collaborators/${{ github.event.comment.user.login }}/permission \
34+
--jq '.permission' 2>/dev/null || echo "none")
35+
36+
if [[ "$PERMISSION" == "write" || "$PERMISSION" == "admin" ]]; then
37+
echo "authorized=true" >> $GITHUB_OUTPUT
38+
else
39+
echo "authorized=false" >> $GITHUB_OUTPUT
40+
fi
41+
42+
- name: Reject unauthorized commenter
43+
if: steps.auth.outputs.authorized == 'false'
44+
env:
45+
GH_TOKEN: ${{ github.token }}
46+
run: |
47+
gh pr comment ${{ github.event.issue.number }} \
48+
--body "⛔ @${{ github.event.comment.user.login }} — only authorized reviewers (repository write access) can trigger the vault audit."
49+
exit 1
50+
51+
- name: Get PR details
52+
id: pr
53+
env:
54+
GH_TOKEN: ${{ github.token }}
55+
run: |
56+
PR=$(gh api /repos/${{ github.repository }}/pulls/${{ github.event.issue.number }} \
57+
--jq '{head_sha: .head.sha, base_sha: .base.sha}')
58+
echo "head_sha=$(echo "$PR" | jq -r '.head_sha')" >> $GITHUB_OUTPUT
59+
echo "base_sha=$(echo "$PR" | jq -r '.base_sha')" >> $GITHUB_OUTPUT
60+
61+
- name: Parse command
62+
id: cmd
63+
run: |
64+
BODY="${{ github.event.comment.body }}"
65+
if echo "$BODY" | grep -qP '^/vault-audit skip .+'; then
66+
echo "type=skip" >> $GITHUB_OUTPUT
67+
REASON=$(echo "$BODY" | sed 's|^/vault-audit skip ||')
68+
echo "reason=$REASON" >> $GITHUB_OUTPUT
69+
else
70+
echo "type=run" >> $GITHUB_OUTPUT
71+
fi
72+
73+
# ── /vault-audit skip <reason> ────────────────────────────────────────────
74+
- name: Handle skip
75+
if: steps.cmd.outputs.type == 'skip'
76+
env:
77+
GH_TOKEN: ${{ github.token }}
78+
run: |
79+
REASON="${{ steps.cmd.outputs.reason }}"
80+
SHA="${{ steps.pr.outputs.head_sha }}"
81+
82+
gh api /repos/${{ github.repository }}/statuses/$SHA \
83+
--method POST \
84+
-f state=success \
85+
-f context="vault-audit" \
86+
-f description="Vault audit skipped by ${{ github.event.comment.user.login }}: $REASON"
87+
88+
gh pr comment ${{ github.event.issue.number }} \
89+
--body "✅ Vault audit skipped by @${{ github.event.comment.user.login }}
90+
91+
**Reason:** $REASON
92+
93+
> ⚠️ This skip applies to the current HEAD (\`${SHA:0:8}\`). Pushing new vault file changes will re-require an audit."
94+
95+
# ── /vault-audit ─────────────────────────────────────────────────────────
96+
- name: Acknowledge audit request
97+
if: steps.cmd.outputs.type == 'run'
98+
env:
99+
GH_TOKEN: ${{ github.token }}
100+
run: |
101+
gh pr comment ${{ github.event.issue.number }} \
102+
--body "🔍 Vault audit triggered by @${{ github.event.comment.user.login }} — running now. Results will appear as a new comment when complete."
103+
104+
- name: Trigger vault audit
105+
if: steps.cmd.outputs.type == 'run'
106+
uses: smartcontractkit/cre-docs/.github/workflows/vault-audit.yml@main
107+
with:
108+
pr_number: ${{ github.event.issue.number }}
109+
head_sha: ${{ steps.pr.outputs.head_sha }}
110+
base_sha: ${{ steps.pr.outputs.base_sha }}
111+
chainlink_repo: ${{ github.repository }}
112+
secrets:
113+
ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
114+
CRE_DOCS_TOKEN: ${{ secrets.CRE_DOCS_TOKEN }}
115+
CHAINLINK_TOKEN: ${{ github.token }}

‎.github/workflows/vault-audit-gate.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Vault Audit Gate
2+
3+
# Posts a "pending" commit status whenever vault-related files are touched, requiring
4+
# an authorized reviewer to trigger the audit before the PR can merge.
5+
6+
on:
7+
pull_request:
8+
types: [opened, synchronize, reopened]
9+
paths:
10+
- 'core/capabilities/vault/**'
11+
- 'core/services/ocr2/plugins/vault/**'
12+
- 'core/services/gateway/handlers/vault/**'
13+
- 'core/services/workflows/v2/secrets.go'
14+
- 'system-tests/tests/smoke/cre/vault_don_test.go'
15+
- 'system-tests/tests/smoke/cre/vault_don_test_helpers.go'
16+
- 'system-tests/lib/cre/vault/**'
17+
18+
jobs:
19+
gate:
20+
runs-on: ubuntu-latest
21+
permissions:
22+
statuses: write
23+
steps:
24+
- name: Post pending status
25+
env:
26+
GH_TOKEN: ${{ github.token }}
27+
run: |
28+
gh api /repos/${{ github.repository }}/statuses/${{ github.event.pull_request.head.sha }} \
29+
--method POST \
30+
-f state=pending \
31+
-f context="vault-audit" \
32+
-f description="Vault audit required — an authorized reviewer must comment /vault-audit"

‎.github/workflows/vault-audit-thread-resolved.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: Vault Audit Thread Resolved
2+
3+
# Fires when any PR review thread is resolved. Calls the cre-docs override-check
4+
# reusable workflow to re-evaluate whether all blocking vault audit findings are resolved
5+
# and updates the commit status accordingly.
6+
7+
on:
8+
pull_request_review_thread:
9+
types: [resolved]
10+
11+
jobs:
12+
check-overrides:
13+
runs-on: ubuntu-latest
14+
permissions:
15+
statuses: write
16+
pull-requests: read
17+
18+
steps:
19+
- name: Check resolver authorization
20+
id: auth
21+
env:
22+
GH_TOKEN: ${{ github.token }}
23+
run: |
24+
RESOLVER="${{ github.event.sender.login }}"
25+
PERMISSION=$(gh api /repos/${{ github.repository }}/collaborators/$RESOLVER/permission \
26+
--jq '.permission' 2>/dev/null || echo "none")
27+
28+
if [[ "$PERMISSION" == "write" || "$PERMISSION" == "admin" ]]; then
29+
echo "authorized=true" >> $GITHUB_OUTPUT
30+
else
31+
echo "authorized=false" >> $GITHUB_OUTPUT
32+
fi
33+
34+
- name: Run override check
35+
if: steps.auth.outputs.authorized == 'true'
36+
uses: smartcontractkit/cre-docs/.github/workflows/vault-audit-override-check.yml@main
37+
with:
38+
pr_number: ${{ github.event.pull_request.number }}
39+
head_sha: ${{ github.event.pull_request.head.sha }}
40+
chainlink_repo: ${{ github.repository }}
41+
secrets:
42+
CHAINLINK_TOKEN: ${{ github.token }}

0 commit comments

Comments
 (0)