From 7622bea7a71b6a0a53c823bc1821b48ad7184880 Mon Sep 17 00:00:00 2001 From: Nickolas Dimitrakas Date: Thu, 17 Sep 2026 10:38:11 -0400 Subject: [PATCH 1/4] ci: scope dependabot rebase workflow secrets Replaces secrets: inherit with an explicit mapping of only the secrets the rebase workflow actually uses, so the release signing and publish credentials this repo carries are no longer part of what gets passed along. Depends on mParticle/mparticle-workflows#102 declaring these secrets as accepted workflow_call inputs. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/dependabot-rebase-branch.yml | 5 ++++- CHANGELOG.md | 6 ++++++ 2 files changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependabot-rebase-branch.yml b/.github/workflows/dependabot-rebase-branch.yml index 9c1abc276..80691b611 100644 --- a/.github/workflows/dependabot-rebase-branch.yml +++ b/.github/workflows/dependabot-rebase-branch.yml @@ -15,4 +15,7 @@ jobs: rebase-branch: name: "Rebase Development onto Dependabot Branch" uses: mParticle/mparticle-workflows/.github/workflows/dependabot-rebase-development.yml@main - secrets: inherit + secrets: + MP_SEMANTIC_RELEASE_BOT: ${{ secrets.MP_SEMANTIC_RELEASE_BOT }} + GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} + GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} diff --git a/CHANGELOG.md b/CHANGELOG.md index b23cfbd80..89fc52021 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,12 @@ ## [Unreleased] +### Core + +#### Security + +- Stop forwarding the full release secret set to the Dependabot Branch Rebase workflow; pass only the specific secrets it needs ([#TBD](https://github.com/mParticle/mparticle-android-sdk/pull/TBD)) + ## [6.1.0] - 2026-09-15 ### Core From 7252b23d24ad7566233fdcde5c3998b8ff62cb82 Mon Sep 17 00:00:00 2001 From: Nickolas Dimitrakas Date: Thu, 17 Sep 2026 10:38:43 -0400 Subject: [PATCH 2/4] docs: link CHANGELOG entry to PR #818 Co-Authored-By: Claude Sonnet 5 --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 89fc52021..da6e58c5e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,7 @@ #### Security -- Stop forwarding the full release secret set to the Dependabot Branch Rebase workflow; pass only the specific secrets it needs ([#TBD](https://github.com/mParticle/mparticle-android-sdk/pull/TBD)) +- Stop forwarding the full release secret set to the Dependabot Branch Rebase workflow; pass only the specific secrets it needs ([#818](https://github.com/mParticle/mparticle-android-sdk/pull/818)) ## [6.1.0] - 2026-09-15 From c4c4c93fe6e6fd416f3421e44a5dcdd7e014dcb3 Mon Sep 17 00:00:00 2001 From: Nickolas Dimitrakas Date: Thu, 17 Sep 2026 10:53:45 -0400 Subject: [PATCH 3/4] ci: remove unused dependabot rebase workflow This workflow only ever ran against the stale development branch (AGENTS.md already flags that branch as unused) and forwarded this repo's full release secret set to an external reusable workflow to do it. Nothing depends on it, so remove it instead of narrowing what it forwards. Co-Authored-By: Claude Sonnet 5 --- .../workflows/dependabot-rebase-branch.yml | 21 ------------------- CHANGELOG.md | 2 +- 2 files changed, 1 insertion(+), 22 deletions(-) delete mode 100644 .github/workflows/dependabot-rebase-branch.yml diff --git a/.github/workflows/dependabot-rebase-branch.yml b/.github/workflows/dependabot-rebase-branch.yml deleted file mode 100644 index 80691b611..000000000 --- a/.github/workflows/dependabot-rebase-branch.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: "Dependabot Branch Rebase" - -on: - push: - branches: - - development - workflow_dispatch: - -permissions: - contents: read - pull-requests: read - checks: write - -jobs: - rebase-branch: - name: "Rebase Development onto Dependabot Branch" - uses: mParticle/mparticle-workflows/.github/workflows/dependabot-rebase-development.yml@main - secrets: - MP_SEMANTIC_RELEASE_BOT: ${{ secrets.MP_SEMANTIC_RELEASE_BOT }} - GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }} - GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }} diff --git a/CHANGELOG.md b/CHANGELOG.md index da6e58c5e..e336cae86 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,7 +6,7 @@ #### Security -- Stop forwarding the full release secret set to the Dependabot Branch Rebase workflow; pass only the specific secrets it needs ([#818](https://github.com/mParticle/mparticle-android-sdk/pull/818)) +- Remove the unused Dependabot Branch Rebase workflow, which forwarded the full release secret set to an external reusable workflow ([#818](https://github.com/mParticle/mparticle-android-sdk/pull/818)) ## [6.1.0] - 2026-09-15 From fe2b9b324be5db86fd871f4369c01ed5b102cc4c Mon Sep 17 00:00:00 2001 From: Nickolas Dimitrakas Date: Thu, 17 Sep 2026 10:57:47 -0400 Subject: [PATCH 4/4] revert: drop manual CHANGELOG entry CHANGELOG entries are generated automatically; don't hand-add them. Co-Authored-By: Claude Sonnet 5 --- CHANGELOG.md | 6 ------ 1 file changed, 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index ac5845504..d09773551 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,12 +2,6 @@ ## [Unreleased] -### Core - -#### Security - -- Remove the unused Dependabot Branch Rebase workflow, which forwarded the full release secret set to an external reusable workflow ([#818](https://github.com/mParticle/mparticle-android-sdk/pull/818)) - ## [6.1.1] - 2026-09-16 ### Kits