norm: auto-fix CI for run 30706503946 - #15
Merged
Conversation
Agent accounts now hold one fine-grained PAT per GitHub org under ~/.config/github-pats/<owner>, selected by lowercasing the owner from the remote URL. Scope is enforced server-side, so the tokens are narrow enough to be ambient — a routine fetch or `gh pr view` no longer costs an approval round-trip. Guarded on .agent: on a machine without the helper installed this block would break github.com auth outright, so it must never render on the Mac. Verified both ways with `chezmoi execute-template --override-data`. Two details that are load-bearing and easy to lose: - `helper =` resets the list first. For multi-valued keys git APPENDS, so without the reset the `!gh auth git-credential` helper above still gets consulted first. - useHttpPath=true, or git omits `path=` from the credential request and the helper has no owner to key a token on.
PR #12 added a gitconfig pointing at a credential helper the repo did not contain, so a rebuilt agent host got config with nothing behind it. Ship the three shims it depends on: gh injects the per-org PAT, resolving owner from -R/--repo, GH_REPO, an `gh api` path, a POSITIONAL owner/repo, or the cwd's origin. No default-org fallback: a repo-less call runs unauthenticated rather than quietly carrying an org credential. git refuses force-push and branch-delete, audits, and notifies. An ACCIDENT CATCHER, not a control — anything running as the agent can call /usr/bin/git or set NORM_ALLOW_FORCE=1. It fails OPEN to real git by design; breaking every git call would be worse than missing one force-push. git-credential-github-org one PAT per org, keyed on the remote URL's owner. All three append to ~/.local/state/norm-gh-audit.jsonl (0600, created before first write — the ambient umask would otherwise leave it world-readable). The token value is never logged. Gated in .chezmoiignore on .agent: `gh` and `git` SHADOW the real binaries, so on a host without ~/.config/github-pats they would break github.com auth outright. Verified both renderings with --override-data. Also wire home/dot_local/bin/* into the shellcheck job. Those files shadow real binaries and were outside the linter's reach; all four pass clean (0.11.0).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-fix for CI failure on
d385a73acae5508c64cabb55ae7da74417290e86(run 30706503946).Run: https://github.com/natevick/dotfiles/actions/runs/30706503946
failed-job logs (fetched at fix time)