Repository navigation
ci: mint GitHub App tokens instead of warpmachineuser PATs - #16655
Merged
Merged
Conversation
bnavetta
approved these changes
Oct 27, 2026
Replace CHANNEL_VERSIONS_REPOSITORY_DISPATCH_TOKEN and DOCS_REPOSITORY_DISPATCH_TOKEN with short-lived installation tokens scoped to the dispatch target, and run the docs settings dispatch only in warp-internal. Co-Authored-By: Warp <agent@warp.dev>
Co-Authored-By: Warp <agent@warp.dev>
harryalbert
force-pushed
the
harry/ci-github-app-tokens
branch
from
October 28, 2026 18:41
bad3488 to
67e57fb
Compare
Contributor
Author
This stack of pull requests is managed by Graphite. Learn more about stacking. |
harryalbert
added a commit
that referenced
this pull request
Oct 28, 2026
…#16674) ## Summary Client releases have failed every day since 10/26 because `create_release.yml` depends on three stored credentials that no longer work. This replaces all of them with per-run OIDC federation, so there's nothing left to rotate. - **`WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY`** (dead SSH key; every build job fails at compile time because `script/install_channel_config` can't clone `warp-channel-config`): `prepare_environment` now takes `install_channel_config: true` instead of `ssh_key`, mints a `contents: read` token for `warpdotdev/warp-channel-config` via Octo STS, rewrites the SSH URL to HTTPS with that token, and sets `CARGO_NET_GIT_FETCH_WITH_CLI=true` so `cargo install --git` honors the rewrite. Only runs in `warpdotdev/warp-internal`; elsewhere the install still falls back gracefully. - **`GOOGLE_APPLICATION_CREDENTIALS`** (service-account JSON key, deleted; all 15 GCS uploads and the Linux PGP key fetch fail with `invalid_grant`): every `google-github-actions/auth` step now uses `workload_identity_provider` + `service_account: github-actions@astral-field-294621` through the shared GitHub Actions WIF pool. - **`GH_APP_CREDENTIALS_TOKEN`** (suspended App; legacy non-stable changelog): replaced with an Octo STS token (`release-changelog`, `contents: read` + `pull_requests: read` on warp-internal). Policy added at `.github/chainguard/release-changelog.sts.yaml`. - `id-token: write` added at the workflow level in `create_release.yml` and on the calling jobs in `cut_new_releases.yml` / `cut_new_release_candidate.yml` (a reusable-workflow caller must grant what the callee declares). Stacked on #16655 (which already touches the two cut workflows). ## Prerequisites (before merge) 1. warpdotdev/warp-terraform#1718 applied — grants the warp-internal WIF principal `workloadIdentityUser` on the release SA. 2. warpdotdev/warp-channel-config#8 merged, and the octo-sts App installed on `warp-channel-config`. 3. This PR's repo-sync lands in warp-internal (the `release-changelog` policy and the workflow changes both need to be on warp-internal `master`). ## Verification - After merge: trigger `Create Release` via `workflow_dispatch` for `dev` (no publish) — every build job must get past `Install dependencies` with the channel config installed. - The next scheduled `Cut New Releases` must upload to `warp-releases/…` and fetch the PGP key without `invalid_grant`. - Then delete `WARP_CHANNEL_CONFIG_ACCESS_SSH_KEY`, `GOOGLE_APPLICATION_CREDENTIALS`, and `GH_APP_CREDENTIALS_TOKEN` from warp-internal. ## Not covered here `ACTION_MONITORING_SLACK` (`account_inactive`) still needs a new Slack bot token — it's why nobody was paged about the failing releases. CHANGELOG-NONE Co-Authored-By: Warp <agent@warp.dev> Co-authored-by: Warp <agent@warp.dev>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Replaces the
warpmachineuserPATsCHANNEL_VERSIONS_REPOSITORY_DISPATCH_TOKENandDOCS_REPOSITORY_DISPATCH_TOKENwith short-lived tokens minted by Octo STS (octo-sts/action@f603d3be9d8dd9871a265776e625a27b00effe05 # v1.1.1). The job's Actions OIDC token is exchanged for a token scoped to the target repo; no App private key, variable, or secret is involved. The action revokes each token when the job ends.Octo STS identities
warp-internal-dispatchwarpdotdev/channel-versionsrepo:warpdotdev/warp-internal:ref:refs/heads/(master|[a-z]+_release/.+)contents: write(required forrepository_dispatch)warp-internal-dispatchwarpdotdev/docsrepo:warpdotdev/warp-internal:ref:refs/heads/mastercontents: write(required forrepository_dispatch)cut_new_releases.ymlruns onmaster(schedule /workflow_dispatch);cut_new_release_candidate.ymlis dispatched on<channel>_release/*branches. Bothupdate_channel_versionsjobs gainid-token: write.notify-docs-settings-changed.ymlruns onmasterpushes; thedispatchjob gainsid-token: write.Other changes
dispatchjob innotify-docs-settings-changed.ymlkeepsif: github.repository == 'warpdotdev/warp-internal'. repo-sync copies these workflows to publicwarp; theocto-sts/actionsteps are harmless there, but the trust policies namewarp-internalsubjects, sowarp-sourced runs would be rejected.Cut New Releases/Cut New Release Candidateare disabled inwarp.Human prerequisites (before merge)
channel-versionsanddocs.warp-internal-dispatchpolicies are merged to the default branches of channel-versions and docs.Post-merge verification
Cut New ReleasesorCut New Release Candidaterun: theupdate_channel_versionsjob passes and therepository_dispatchrun in channel-versions showsocto-sts[bot]astriggering_actor.app/src/settings_view/**:notify-docs-settings-changedpasses in warp-internal and is skipped in warp; the docs dispatch run showsocto-sts[bot]astriggering_actor.CHANNEL_VERSIONS_REPOSITORY_DISPATCH_TOKENandDOCS_REPOSITORY_DISPATCH_TOKEN.Testing
actionlinton the 3 changed files: no new findings (the pre-existing shellcheck findings in untouchedrun:blocks are unchanged vsmaster).Opened from patches authored by @captainsafia.
CHANGELOG-NONE
Co-Authored-By: Warp agent@warp.dev