fix(ci): hand each reusable workflow the secrets it reads - #860
Merged
Merged
Conversation
secrets: inherit passes every secret this repository holds, so a workflow that reads three of them received all eighteen, including the App Store Connect key, the Match passphrase and the Firebase service account. The prepare pipeline reads none at all and received the same eighteen. Each reusable workflow now declares what it reads and each caller passes exactly that. The prepare pipeline is handed nothing. The declaration is also the check: a secret added to a callee without being declared fails at the call rather than resolving to an empty string, which is the shape this class of bug usually takes.
Contributor
|
CI Status: 20 required jobs green, 14 passed and 6 skipped by path filter. All job results
Commit |
The install composite writes a git credential for the signing repository into GITHUB_ENV, and every later step in the job inherits it. Two of those steps resolved third-party code from a moving reference, one of them a branch rather than a tag, so whatever that reference pointed at when the job ran could read the credential out of the environment. All four are now pinned to a commit. Marks as optional the six secrets that are tolerated empty or read only by the Safetynet configuration. Five of them are not set on this repository at all, so declaring them required described something that was not true. Corrects the note that told the next reader reusable workflows need secrets: inherit, which now contradicts the workflows themselves.
Contributor
iOS simulator previewBuilt from gh run download 35534170644 --name simulator-preview-d029ec468
unzip polkadot-app-*.app.zip
xcrun simctl install booted polkadot-app.app
xcrun simctl launch booted io.parity.polkadotapp.developOr download it in a browser, which arrives as a zip wrapping An arm64 simulator slice, so it needs an Apple Silicon Mac and does not |
The re-homed iOS copy of this workflow is pinned and passes nothing; the Android one still resolves a third-party reusable workflow from a tag that can move and hands it every secret this repository holds. It is dormant, because only the root of the repository is read for workflows, but it is the original shape of the problem waiting for those workflows to be re-homed.
filvecchiato
approved these changes
Sep 21, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Sep 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
secrets: inheritpasses every secret this repository holds, so a workflow that reads three of them received all eighteen, including the App Store Connect key, the Match passphrase and the Firebase service account. The prepare pipeline reads none at all and received the same eighteen.Each reusable workflow now declares what it reads, and each caller passes exactly that. The prepare pipeline is handed nothing. Eight of the fourteen are required; the six that are tolerated empty or read only by the Safetynet configuration are optional, which is also true of five of them that are not set on this repository at all.
This matters most for
ios-release-distribution.yml, which triggers onpull_request. Under inherit that build could reachFASTLANE_RW_PAT, which has write access to the signing repository, along withCREDENTIAL_FILE_CONTENT,SIGNER_BOT_SVC_TOKENand the publishing credentials. It needs none of them and can no longer see any of them.It also pins the four actions in the iOS install composite. That step writes a credential for the signing repository into the job environment, and every later step inherits it, so two of them were resolving third-party code from a moving reference, one of which is a branch rather than a tag.
Part of #791. Still outstanding there: a dormant
secrets: inheritwith a mutable reference in the vendored Android tree, which would reopen this the moment those workflows are re-homed, and around thirty unpinned first-party action references across the iOS workflows.