feat(scripts): one-verb sync of Forgejo Actions secrets from SSM #479

Merged

coilysiren merged 2 commits from feat/sync-actions-secrets into main

2026-07-12 06:44:38 +00:00

coilysiren commented

2026-07-12 06:41:18 +00:00

Owner

Split out of #475 so ward exec sync-actions-secrets lands on main before the release reshape that depends on CI_RELEASE_TOKEN. aos had no TELEGRAM_* secrets (every alert step failed, runs 986..1062) and no CI_RELEASE_TOKEN; ward lacked TELEGRAM_* too. Values flow SSM -> Forgejo API in-process. Kai runs the verb once (an agent permission classifier correctly blocks me from writing decrypted SSM values to the secrets API myself).

Split out of #475 so `ward exec sync-actions-secrets` lands on main before the release reshape that depends on CI_RELEASE_TOKEN. aos had no TELEGRAM_* secrets (every alert step failed, runs 986..1062) and no CI_RELEASE_TOKEN; ward lacked TELEGRAM_* too. Values flow SSM -> Forgejo API in-process. Kai runs the verb once (an agent permission classifier correctly blocks me from writing decrypted SSM values to the secrets API myself).

coilysiren added 1 commit

2026-07-12 06:41:19 +00:00

feat(scripts): one-verb sync of Forgejo Actions secrets from SSM

ci / gate (pull_request) Successful in 11s

Details

2115c561a9

scripts/sync-actions-secrets.py + `ward exec sync-actions-secrets`: the
aos repo had no TELEGRAM_* Actions secrets (every main-failure alert
step itself failed, runs 986..1062) and no CI_RELEASE_TOKEN (which the
aos#475 two-stage promote needs). Ward lacked the TELEGRAM_* pair too.
Values flow SSM -> Forgejo secrets API in-process, never disk or argv;
`-- --dry-run` previews the mapping.

Split out of the aos#475 branch so the verb lands before the release
reshape that depends on the secret.

Refs #469

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Cym37PsLtA61parAQyeAw

coilysiren added 1 commit

2026-07-12 06:43:59 +00:00

fix(sync-secrets): ward needs CI_RELEASE_TOKEN too + document the read:user requirement

ci / gate (pull_request) Successful in 17s

Details

e8f028f7d9

The live stage-2 test showed ward's existing CI_RELEASE_TOKEN lacks
read:user: Forgejo records its pushes with an empty actor and silently
enqueues no workflow (runs 1831/1833 moved the release branch, stage 2
never fired). The token must be reminted with read:user before syncing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016Cym37PsLtA61parAQyeAw

coilysiren merged commit f7067f2b4f into main

2026-07-12 06:44:38 +00:00

coilysiren referenced this pull request from a commit

2026-07-12 06:44:40 +00:00

Merge pull request 'feat(scripts): one-verb sync of Forgejo Actions secrets from SSM' (#479) from feat/sync-actions-secrets into main

coilysiren referenced this pull request from a commit

2026-07-12 07:07:20 +00:00

fix(ci): trim the over-cap comment that reddened main + make the PR gate match the release gate

coilysiren referenced this pull request

2026-07-12 07:07:34 +00:00

fix(ci): trim the over-cap comment that reddened main + make the PR gate match the release gate #480