Add CI to validate key PRs, auto-merge safe ones, and regenerate @all - #643
Merged
Conversation
Validate every ssh/*.pub file a PR adds or modifies: each line must be a parseable public key (no private key material, no DSA, RSA >= 2048 bits, sane filenames, no reserved @-prefixed names). PRs from repo/org members that only touch ssh/*.pub files are merged automatically once validation passes, and ./update is then run in CI to regenerate the autogenerated branch. A push-triggered workflow covers manually merged PRs, since GITHUB_TOKEN merges don't trigger it from the auto-merge path. Signed-off-by: David Galloway <david.galloway@ibm.com>
Tags are mutable; pin to the v7.0.1 commit instead. Signed-off-by: David Galloway <david.galloway@ibm.com>
falcocer-ibm
approved these changes
Aug 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
.github/scripts/validate-keys.sh— validates everyssh/*.pubfile a PR adds or modifies (diffed against the merge base). Each non-blank line must parse withssh-keygen -lf; the check fails on private key material, DSA keys, RSA keys under 2048 bits, empty key files, bad filename characters, and reserved@-prefixed names. It also reports whether the PR touches onlyssh/*.pubfiles..github/workflows/pr-validate.yml— runs on PRs tomain: validate → auto-merge → run./update. Auto-merge only happens when validation passes and the PR branch lives in this repo (not a fork), the author is an org member/owner/collaborator, the PR isn't a draft, and it changes nothing butssh/*.pubfiles. Everything else still gets validated but waits for a human merge. After merging, CI checks outmainand runs the existing./updatescript (settingbranch.main.remoteand a git identity first, which the script needs and Actions checkouts don't provide)..github/workflows/regenerate.yml— regenerates theautogeneratedbranch on any push tomaintouchingssh/**(manual merges, direct pushes). Needed because pushes made withGITHUB_TOKENdon't trigger other workflows, so the PR workflow runs./updateitself; a shared concurrency group prevents the two from racing.README.rst— documents the new flow.Why
Merging into this repo grants SSH access to the Sepia lab, so a green key check alone is deliberately not sufficient to auto-merge — the author-association and same-repo gates are the actual access control; validation just catches broken keys before they land.
Notes for reviewers
@-prefixed filenames, mixed key+non-key PRs, and deletion-only PRs.ssh-dsskeys are untouched; the policy only applies to files a PR adds or modifies.maingains branch protection requiring reviews, theGITHUB_TOKENmerge will be rejected and would need a bypass or an admin PAT.