Stop retrying organization-blocked workflow permission override - #71
Merged
Merged
Conversation
Contributor
OpenTofu TestOpenTofu test passed. View run output |
Contributor
Author
|
Validation completed at 396576e: test and plan succeeded in https://github.com/makeitworkcloud/tfroot-github/actions/runs/35519220336 . The redacted plan comment reports |
xnoto
marked this pull request as ready for review
September 20, 2026 15:23
Contributor
OpenTofu PlanOpenTofu plan passed. View run outputNo changes. Your infrastructure matches the configuration.
OpenTofu has compared your real infrastructure against your configuration and
--
No changes. Your infrastructure matches the configuration.
OpenTofu has compared your real infrastructure against your configuration and |
7 tasks
xnoto
added a commit
that referenced
this pull request
Sep 20, 2026
## Summary Prepare repository-scoped release authentication without weakening organization Actions policy. Add terraform-libvirt-domain as one recipient of the existing CHART_UPDATER_GITHUB_APP_PRIVATE_KEY and document the proposed consumer/installation gates. No key value, App permission, installation, or organization policy is changed in source. Fixes: N/A — companion to module release-auth migration; HTTP409 root blocker resolved separately by #71. ## Type of change - [x] Documentation - [x] Infrastructure (OpenTofu root or module) ## Validation - [ ] Required test and plan pass — pending. - [x] Generated README not hand-edited; no new resource types. Independent adversarial/security/delivery reviews ADVANCE for draft PR creation. Expected plan: exactly one new repository Actions secret for terraform-libvirt-domain, with no unrelated settings or App/installation changes. Do not retrieve or paste private-key values. PR creation is not authorization to apply. ## Impact and rollout MERGE/APPLY HOLD until owner explicitly accepts adding this shared-key recipient and confirms makeitworkbot is installed for terraform-libvirt-domain using the selected-repository installation. Installation ownership stays manual under this root's runbook. Security distinction: workflow repositories input restricts the minted token, NOT the private key. A repository holding this key could request tokens for other repositories already granted to the App. This adds a ninth recipient; owner must accept that expanded credential exposure before merge. Then merge/apply this producer first; verify successful delivery without retrieving values. Only afterward merge the companion consumer workflow, which requests Contents and Pull requests write for terraform-libvirt-domain only. No Issues permission increase is proposed. The consumer merge is publication-capable and separately gated. Rollback removes the recipient through a reviewed root change; it does not revoke the shared key globally. ## Safety and secrets - [x] No plaintext/decrypted secrets, state, kubeconfigs, tokens, or sensitive plans - [x] No local OpenTofu init/plan/apply/destroy/import/state operations - [x] Credential exposure, manual installation, and staged rollout gates explained AI-assisted. Draft only, no auto-merge, no upstream communications.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Remove the repository-level workflow-permissions override whose creation repeatedly fails with HTTP409. This is a narrow root-pipeline unblock, NOT a complete release-automation fix and NOT an organization-policy change.
Deleted declaration: github_workflow_repository_permissions.release_automation for terraform-libvirt-domain (default token read; can_approve_pull_request_reviews=true). Initial apply34911928267 and later35485521447 failed creating it. Failure history is not proof of state absence: mandatory plan gate below.
Fixes: N/A — owner requested proceeding with remaining HTTP409 remediation.
Type of change
Validation
Adversarial/security/delivery reviews cleared PR creation only. MERGE HOLD until resulting-head test passes, generated README row is removed by CI, and plan reports exactly0add/0change/0destroy (No changes). Any change/destroy means restore the declaration and investigate; do not reset repository permissions. No local OpenTofu/SOPS/state operations or raw state/credentials retrieved.
Impact and rollout
Draft, auto-merge off. No consumer workflow, App/PAT, secret recipient, installation, or organization setting changed. A later explicitly approved main apply should stop attempting the blocked PUT; verify actual success separately.
terraform-libvirt-domain release.yml remains unchanged and still uses GITHUB_TOKEN. Removing the failed override DOES NOT unblock its release-PR creation. App-based remediation would require explicit new secret-recipient/installation/permissions approval and review of tag-trigger/duplicate-release behavior; not included here.
Safety and secrets
AI-assisted; no upstream communications or live policy mutation. Do not merge until fresh zero-plan evidence and owner approval.