From dc1972515b786522c27c669ee2fd8912c1aac898 Mon Sep 17 00:00:00 2001 From: breis Date: Thu, 23 Jul 2026 14:25:31 -0400 Subject: [PATCH] =?UTF-8?q?ci:=20drop=20the=20edgecommons=20git-auth=20ste?= =?UTF-8?q?p=20=E2=80=94=20the=20dependency=20repo=20is=20public?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `edgecommons/edgecommons` is public, so cargo fetches the git dependency anonymously. The coverage job's "Authenticate to the private edgecommons git dependency" step rewrote the https URL with an x-access-token from EDGECOMMONS_READ_TOKEN — now unnecessary, and actively harmful once that secret is retired: it had no `|| github.token` fallback, so an empty token would inject `x-access-token:@github.com` and 401 even against the public repo. Removing the step lets the anonymous public fetch stand. The `ci` job's `secrets: inherit` is left in place (harmless; the reusable workflow guards the token with `if [ -n ]`), and its stale comment is corrected to match. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01LsX7cWVGLszurNYMVwMJGo --- .github/workflows/ci.yml | 22 ++++------------------ 1 file changed, 4 insertions(+), 18 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 3691121..fd08500 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -9,9 +9,9 @@ on: jobs: ci: - # Reusable component CI from the org defaults repo. `secrets: inherit` passes the org-level - # EDGECOMMONS_READ_TOKEN so cargo can fetch the private edgecommons git dependency. The repo must be - # added to that secret's repository allow-list (org Actions secrets, via the REST API). + # Reusable component CI from the org defaults repo (build + test + clippy -D warnings). + # `edgecommons/edgecommons` is public, so cargo fetches the git dependency anonymously and no + # token is required; `secrets: inherit` is retained but passes nothing CI now depends on. permissions: contents: read uses: edgecommons/.github/.github/workflows/component-ci.yml@main @@ -50,23 +50,9 @@ jobs: run: rustup toolchain install stable --profile minimal --component llvm-tools-preview - name: Install cargo-llvm-cov uses: taiki-e/install-action@cargo-llvm-cov - - name: Authenticate to the private edgecommons git dependency - env: - # Same org read token the reusable workflow uses (secrets: inherit); the repo must be on - # that secret's allow-list. Rewrites the https git URL so cargo can fetch the private dep. - EDGECOMMONS_READ_TOKEN: ${{ secrets.EDGECOMMONS_READ_TOKEN }} - run: | - git config --global \ - url."https://x-access-token:${EDGECOMMONS_READ_TOKEN}@github.com/edgecommons/edgecommons.git".insteadOf \ - "https://github.com/edgecommons/edgecommons.git" - git config --global \ - url."https://x-access-token:${EDGECOMMONS_READ_TOKEN}@github.com/edgecommons/edgecommons".insteadOf \ - "https://github.com/edgecommons/edgecommons" - git config --global \ - url."https://x-access-token:${EDGECOMMONS_READ_TOKEN}@github.com/".insteadOf \ - "https://github.com/" - name: Coverage gate (90% lines; composition root + main.rs + test-only messaging fake excluded) env: + # edgecommons/edgecommons is public; cargo fetches the git dependency anonymously. CARGO_NET_GIT_FETCH_WITH_CLI: "true" run: > cargo llvm-cov --locked --features streaming,streaming-file-parquet,streaming-file-avro,scripting-lua