Repository navigation
github-backup(worker deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu performs a real deploy (upload + secret reset) #3287
Description
github-backup(worker deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu performs a real deploy (upload + secret reset)
Summary
infra/github-backup/worker/deploy.mjs (landed today in #3280 / commit 307a250) parses its CLI flags by membership only and never rejects an argument it does not recognize:
deploy.mjs:40-47—const dryRun = args.includes("--dry-run"),args.indexOf("--deploy-version"); there is no allowlist check overargsanywhere in the file.
So deploy.mjs --dry-rnu (or any unknown flag, e.g. --bogus-flag) is silently treated as a plain deploy of HEAD: it uploads a new Worker version, creates the 100% deployment when the version is not already live, and (re)sets the live Worker secrets DRAIN_BEARER and GITHUB_WEBHOOK_SECRET from Bitwarden — then exits 0 reporting the Worker live. The operator who typo'd the dry-run flag gets no signal that a production deploy just happened.
This is the same defect class already filed for the sibling deploy/install scripts — #3264 (pkarr-worker deploy.mjs), #3278 (opencode-claimant install.mjs), #3281 (id-mail worker deploy.mjs) — but this script is new code merged after those filings and is not covered by any of them.
Evidence (verified this run)
Laptop probe ~/git/fleet/probe-2026-10-31-laneB-ghbdeploy/ (deploy.mjs copied verbatim; sha256 feb5ebfc3d11a9a592d444e9722b8548973e533651fa9ffdac982dac28ee2ad7, matching main cf1b243f), with bws / wrangler / git stubbed to log every invocation and return canned JSON:
- Control —
node deploy.mjs --dry-run: exit 0; the only stub call iswrangler deploy --dry-run; prints "dry run: config builds, nothing uploaded". node deploy.mjs --dry-rnu: exit 0; stub log shows the FULL real deploy sequence —git rev-parse HEAD,wrangler versions list,wrangler versions upload --tag git-abcdef012345 …,wrangler deployments list,wrangler secret put DRAIN_BEARER,wrangler secret put GITHUB_WEBHOOK_SECRET, and the live report (live: https://developing-today-backup.developing-today.workers.dev at version …). (Noversions deploycall in this run only because the stub reported the just-uploaded version as already live; against real wrangler state a fresh upload is not live, so the deployment-create step runs too.)node deploy.mjs --bogus-flag: exit 0; identical full deploy sequence.
Why it matters
This script is the deploy path for the backup webhook receiver Worker. A one-character typo in the safety flag turns a no-op validation into a production deploy of whatever HEAD happens to be, including resetting the live Worker's secrets — with a success exit code and a normal "live:" report, so the mistake is invisible in the moment and only surfaces if the deployed code misbehaves.
Acceptance criteria
- Any argument that is not
--dry-runor--deploy-version <id>(with a present, non-flag value) makes the script exit non-zero with a usage error naming the offending argument, before anybws/wrangler/gitcall. --deploy-versionfollowed by another flag or nothing is rejected the same way.--dry-run, bare (deploy HEAD), and--deploy-version <id>behavior is unchanged.- A stubbed-CLI test (or equivalent) pins: unknown flag → zero stub calls + non-zero exit;
--dry-run→ only the dry-run validation call.
Activity
dezren39 commentedon Nov 1, 2026
🤖 Agent note · filed
infra/github-backup/worker/deploy.mjs(maincf1b243f, sha256feb5ebfc…) only membership-checks--dry-run/--deploy-version(deploy.mjs:40-47) and never rejects unknown arguments. Laptop probe~/git/fleet/probe-2026-10-31-laneB-ghbdeploy/with stubbedbws/wrangler/git:--dry-run→ validation call only;--dry-rnuand--bogus-flag→ exit 0 after the full real sequence (versions upload, deployments list,secret put DRAIN_BEARER,secret put GITHUB_WEBHOOK_SECRET, live report). Same defect class as pkarr-worker(deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu or --deploy-version=<id> performs a real deploy of HEAD #3264 / opencode-claimant(install): unrecognized arguments are silently ignored — a typo'd --dry-rnu performs a real install, and a typo'd --stor writes the real OpenChamber store #3278 / id-mail(worker deploy): unrecognized arguments are silently ignored — a typo'd --dry-rnu enters the real deploy sequence and force-deletes the retired 'id-mail' Worker #3281, but a new script none of them covers.dezren39 commentedon Nov 1, 2026
Adopted as Phase 1 of design #3352. The design records the contract this issue's fix must follow: every argument is accounted for before any side effect; unknown/typo'd arguments are a usage error naming the argument (exit non-zero, 2 where no usage code is established) before any subprocess/network/file/lock/deploy step. Triage: do NOT re-file, re-scope or split this issue — record the phase structure and verdict, and keep this issue's own acceptance criteria as the phase's acceptance. Design doc: files/designs/code-operator-argument-contract.md (keep-the-four-repos-healthy goal workspace).
52 remaining items
dezren39 commentedon Nov 2, 2026
🤖 Agent note · parked — CI pending on PR #4475
basiccheck still pending. No merge per standing criteria until green.fixed_merged. Worktree/home/user/git/fleet/task-5716, branchqueue/5716-3287-github-backup-argspreserved.dezren39 commentedon Nov 2, 2026
🤖 Agent note · picked up
fix(github-backup): reject empty --deploy-version value in deploy.mjs (…
Merge pull request #4475 from developing-today/queue/5716-3287-github…
dezren39 commentedon Nov 2, 2026
🤖 Agent note · done
--deploy-version ""value was still accepted — fixed in commit 4d05166 (rejected with the usage error, exit 2, before any subprocess) with regression checks added; Codex re-review of the new head completed with no findings.