chore(secrets): re-seal token from FuzeInfra hand-off (fuzeagent-registration) - #163
chore(secrets): re-seal token from FuzeInfra hand-off (fuzeagent-registration)#163izzywdev wants to merge 5 commits into
Conversation
…stration) Automated credential hand-off from izzywdev/FuzeInfra (FuzeInfra#510). Only the encrypted `token` entry changed; every other key in this SealedSecret is byte-identical (kubeseal --merge-into). The value was sealed --scope strict for fuzeagent/fuzefront-registration, so this ciphertext decrypts nowhere else. No plaintext was logged, committed, or handled by a human at any point. Credential fingerprint (sha256[:16]): 2ad2dff4d1564d63 Previously deployed fingerprint: absent
This branch's head was pushed by an identity whose pushes do not trigger workflows, so the PR had ZERO checks and could never satisfy branch protection - nothing red to investigate, just nothing at all. A commit from a collaborator-backed identity produces a synchronize event with a real pusher, which is what actually starts CI.
fuze-code-review — automated verdictNo verdict was reached — this run is NOT an approval. fuze-code-action conclusion was 'failure', not 'success' — no review was produced, so none can be approved. See the per-rung 'fuze-code-action' notices in the job log for the specific classification (availability / task / declined) and, on an availability failure, the named provider error that triggered it. This is reported as a failed check deliberately: a review that could not run must never be silently indistinguishable from a clean one. |
…n, so no workflows ran)
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| - name: Mint fuze-agent App installation token | ||
| id: app | ||
| if: inputs.app-id != '' && inputs.private-key != '' | ||
| uses: actions/create-github-app-token@v1 |
fuze-code-review — automated verdictNo verdict was reached — this run is NOT an approval. fuze-code-action conclusion was 'failure', not 'success' — no review was produced, so none can be approved. See the per-rung 'fuze-code-action' notices in the job log for the specific classification (availability / task / declined) and, on an availability failure, the named provider error that triggered it. This is reported as a failed check deliberately: a review that could not run must never be silently indistinguishable from a clean one. |
2 participants
Automated credential hand-off from
izzywdev/FuzeInfra(FuzeInfra#510).fuzeagent-registrationfuzeagent/fuzefront-registration, keytoken(--scope strict)deploy/contabo/sealed/fuzefront-registration.yaml(updated withkubeseal --merge-into; all other keys untouched)2ad2dff4d1564d63fuzeagent:absentThis PR contains ciphertext only. It was produced without any human
or job log ever seeing the plaintext: FuzeInfra read its own Secret
in-cluster, sealed it against the controller cert, and published the
result. Merging it lets Argo CD sync the value into
fuzeagent.