fix(ci): correct 3 secret-name mismatches causing silent no-ops#352
Merged
Conversation
Found during a post-breach credential audit: these workflows reference secret names that don't exist on this repo, so the affected steps silently degrade (empty token / fallback) instead of failing loudly. - supervised-fleet-scan.yml: referenced secrets.FLEET_SCAN_PAT, which has never existed here — only HYPATIA_SCAN_PAT is configured, and its scope (Contents+Dependabot alerts read) is exactly what this step's own comment says it needs. Pointed it at the secret that actually exists. - inbox-steward.yml "Validate PRs": referenced secrets.FARM_PAT (never configured). This step only reads check-runs/reviews/PRs on this same repo — it never needed a cross-repo PAT. Switched to secrets.GITHUB_TOKEN, which is sufficient and always present. - inbox-steward.yml "Send dispatch to Hypatia": same missing FARM_PAT reference, but this step genuinely dispatches cross-repo, so it keeps the same PAT-with-fallback shape — just pointed at FARM_DISPATCH_TOKEN, the secret that's actually meant to carry that capability (currently dead pending redistribution of the new FARM_DISPATCH_PAT value, tracked separately). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Post-breach credential audit found two workflows referencing secret names that don't exist on this repo, causing silent degradation instead of loud failure:
supervised-fleet-scan.yml— referencedsecrets.FLEET_SCAN_PAT(never configured). OnlyHYPATIA_SCAN_PATexists, and its scope matches exactly what this step's own comment says it needs (Contents + Dependabot alerts read, for cross-repo CVE scanning). Pointed at the secret that actually exists.inbox-steward.yml"Validate PRs" — referencedsecrets.FARM_PAT(never configured). This step only reads check-runs/reviews/PRs on${{ github.repository }}itself — never needed a cross-repo PAT. Switched tosecrets.GITHUB_TOKEN.inbox-steward.yml"Send dispatch to Hypatia" — same missingFARM_PAT, but this step genuinely dispatches cross-repo, so kept the PAT-with-fallback shape, just pointed atFARM_DISPATCH_TOKEN(the secret that's actually meant to carry that capability — currently dead pending a separate redistribution effort, tracked elsewhere; the|| secrets.GITHUB_TOKENfallback means this degrades safely either way).No behavior regression possible — all three references were 100% guaranteed-broken before this change (referencing secrets that don't exist), so this is strictly an improvement.
Note
Unrelated to this PR:
git pushsurfaced "GitHub found 4 vulnerabilities on this repo's default branch (1 high, 1 moderate, 2 low)" via Dependabot — flagging for separate follow-up, not touched here.🤖 Generated with Claude Code