Repository navigation
Conversation
11.2.0 Release
daily-update.yml and python-tests.yml's publish job, the only two jobs that use cloudcheck-update-bot's key, now run in the data-update environment (deployment branch: stable only, no admin bypass). They read the App ID from the environment variable CLOUDCHECK_APP_ID and the key (and BBOT_IO_API_KEY) from environment secrets, so no other branch, pull request or dispatched copy of a workflow can read them. The App token is minted for this repository only, with contents write only, and both jobs drop to contents: read: the push and the tag push already use the App token, not GITHUB_TOKEN. Safe to merge before the new key is in place: inside an environment job an environment secret overrides the repository secret of the same name, and the repository secret still applies when the environment has none. Refs blacklanternsecurity/bbot-enterprise#406, blacklanternsecurity/.github-config#16 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Review on #323: - create-github-app-token with owner set and repositories empty mints a token for every repository in the installation. On a scheduled run github.event.repository.name may be empty, so drop owner and repositories: with neither set, the token covers only this repository. - publish used the bot's key only to push the release tag, and held a token that can push straight to stable while maturin runs third-party build code. It now pushes the tag with GITHUB_TOKEN (contents: write), which the stable PR rule applies to, and leaves data-update. Checkout keeps no credentials, so only the tag step gets the token; the build steps can't push branches or move tags. daily-update is now the only job that uses the bot's key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…-data-update ci: read the bot's key from the stable-only data-update environment
liquidsec
approved these changes
Oct 23, 2026
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Back-merge
stableintodev: #323's workflow changes and the daily signature data.Merge with "Create a merge commit", not squash or rebase, so
devandstablekeep a common history.No conflicts.
devhasn't touched these files since the two branches split ate07573d:.github/workflows/daily-update.yml,.github/workflows/python-tests.yml,README.md,cloud_providers_v3.json.