fix(pr-pipeline): scope read-runner caller secrets per caller in check-read-caller-keys
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 74/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- github-actions, javascript
Research direction
Start with scripts/check-read-caller-keys.mjs and inspect how it reads caller workflows and validates ALLOWED_SECRETS; use the existing automations-token handling as a reference. Add or locate the script's tests and cover each caller's own secret, another lane's secret, and a caller missing from the map. Done means all three cases behave as specified and the checks pass.
Written by the indexing model from the issue text.
Description
Problem
scripts/check-read-caller-keys.mjs holds the allowed secret names for read-runner callers in one global set, ALLOWED_SECRETS (line 30 after #8691). So any caller of pr-run-activity-read.yml may pass any allowed lane credential, for example issue_lane_claude_code_oauth_token from a caller that is not the issue lane, and the check stays green. The automations token already works this way.
Abusing this needs a workflow change that is already on main, so it is a hardening item, not a live gap.
Fix
Replace the global set with a per-caller map from caller workflow file to the secret names it may pass, for example work-resolve-issue.yml → the ISSUE_LANE_ names and pr-unblock.yml → the AUTOMATIONS_ names. A caller that passes a secret outside its own entry fails the check. Add tests:
- each caller's own secret passes;
- another lane's secret fails;
- a caller missing from the map fails.
Refs: #8691
- Dominant language
- Shell
- Stars
- 22
- Forks
- 2
- Avg merge
- 7h 57m
- Merged PRs (30d)
- 938
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from melodic-software/claude-code-plugins
-
priority: low
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
melodic-software/claude-code-plugins#8831 · 1 comment ·
Maintainers usually reply within 1 day
-
priority: medium status: confirmed
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
melodic-software/claude-code-plugins#8801 ·
Maintainers usually reply within 1 day
-
priority: low status: confirmed
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
melodic-software/claude-code-plugins#8799 ·
Maintainers usually reply within 1 day
-
priority: medium
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
melodic-software/claude-code-plugins#8730 · 1 comment ·
Maintainers usually reply within 1 day
-
fix(source-control): ready-hold check treats a Hold: line that says do not merge as a flip holdOpenpriority: medium
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
melodic-software/claude-code-plugins#8708 · 1 comment ·
Maintainers usually reply within 1 day
All issues in melodic-software/claude-code-plugins
Similar issues
-
bug github_actions security
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
DewaldOosthuizen/tech-cheat-sheets-and-notes#388 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
alignment
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
btclib-org/portanode#710 ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Maintainers usually reply within 1 day
-
bug needs-triage
Difficulty 1/5 Under an hour Newbie friendliness 67/100
mattpocock/skills#1312 ·
Maintainers usually reply within 1 day