fix(bootstrap): use valid SSO credential names and fail closed

[devantler]

🤖 Generated by the Daily AI Engineer (Codex instance)

Evidence

At cde05878304d77df263679ca17653dc25ff7573b, actionlint reports four findings in .github/workflows/bootstrap.yaml:

• vars.GITHUB_APP_CLIENT_ID uses the reserved GITHUB_ prefix.
• The three generated-secret assignments mask openssl failures behind export (SC2155).

The bootstrap contract also requires secrets.GITHUB_APP_CLIENT_SECRET. GitHub forbids the GITHUB_ prefix for both configuration variables and Actions secrets, so neither documented SSO credential can be created as named.

GitHub resolves unset vars and secrets references to empty strings. The workflow then writes those empty values into both local and production bootstrap payloads, leaving Dex without usable GitHub connector credentials.

A Bash negative control replacing openssl with a command that exits 7 still continued under set -euo pipefail and produced three zero-length secret values, confirming that the current export VAR="$(openssl ...)" form fails open.

The Bootstrap workflow has no recorded runs, so this is static analysis plus an executed negative control rather than an observed live failure. No matching report exists among the repository's issues or pull requests.

Impact

A new template consumer cannot configure bootstrap as documented. Dispatch may proceed with empty SSO credentials, potentially provisioning infrastructure before authentication fails and leaving a partial or unusable platform.

Expected behavior

Bootstrap accepts valid, documented SSO credential names and stops before rendering, encryption, commit-back, or provisioning whenever a required credential or generated secret is missing.

Acceptance criteria

• Replace both user-facing SSO names with non-reserved names consistently across the workflow and documentation.
• Validate every required bootstrap variable and secret as non-empty before mutating files or provisioning infrastructure.
• Generate each internal secret in a separate assignment before export so an openssl failure terminates the step.
• Add negative controls proving a missing SSO credential and a failed secret generator both stop before cluster creation.
• Make all workflows actionlint-clean and add regression coverage for reserved variable and secret names; actionlint alone does not catch the invalid secret name.
• Keep the rendered Kubernetes keys github_app_client_id and github_app_client_secret unchanged.

Rough size: S.