GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — ci: run main-only secret consumers in the main environment by sreya · Pull Request #31763 · coder/coder

Conversation

@sreya

@sreya sreya commented Nov 5, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@sreya
ci: run main-only secret consumers in the main environment
552db7d
@sreya
sreya requested review from jdomeracki-coder and nickvigilante as code owners November 5, 2026 02:06
@github-actions github-actions Bot assigned sreya Nov 5, 2026
@sreya
Merge branch 'main' into ci/main-environment
0dbcba4
This was referenced Nov 6, 2026
ci: run contrib.yaml secret consumers in the main environment on release/2.29 #31816
Merged
ci: run contrib.yaml secret consumers in the main environment on release/2.30 #31817
Merged
ci: run contrib.yaml secret consumers in the main environment on release/2.31 #31818
Merged
ci: run contrib.yaml secret consumers in the main environment on release/2.32 #31819
Merged
ci: run contrib.yaml secret consumers in the main environment on release/2.33 #31820
Merged
ci: run contrib.yaml secret consumers in the main environment on release/2.34 #31821
Merged
ci: run contrib.yaml secret consumers in the main environment on release/2.35 #31822
Merged
ci: run contrib.yaml secret consumers in the main environment on release/2.36 #31823
Merged
ci: run contrib.yaml secret consumers in the main environment on release/2.37 #31824
Merged
ci: run contrib.yaml secret consumers in the main environment on release/2.38 #31825
Merged
ci: run contrib.yaml secret consumers in the main environment on release/2.39 #31826
Merged
sreya added a commit that referenced this pull request Nov 6, 2026
@sreya
ci: run contrib.yaml secret consumers in the main environment
57571ff 
Backport of the `contrib.yaml` change in #31763 to `release/2.29`.

`cla` now run in the `main` environment and only for PRs that target
`main` (or CLA comments, which always run from the default branch).
`pull_request_target` runs this file from the base branch, so without
this, PRs targeting `release/2.29` keep reading `CDRCI2_GITHUB_TOKEN`
from repo-level secrets, which blocks deleting them. On this branch the
jobs now skip, matching `main`; a skipped job satisfies required checks.

@sreya for review.

---
_Generated with Coder Agents._
sreya added a commit that referenced this pull request Nov 6, 2026
@sreya
ci: run contrib.yaml secret consumers in the main environment
35f567a 
Backport of the `contrib.yaml` change in #31763 to `release/2.31`.

`cla` now run in the `main` environment and only for PRs that target
`main` (or CLA comments, which always run from the default branch).
`pull_request_target` runs this file from the base branch, so without
this, PRs targeting `release/2.31` keep reading `CDRCI2_GITHUB_TOKEN`
from repo-level secrets, which blocks deleting them. On this branch the
jobs now skip, matching `main`; a skipped job satisfies required checks.

@sreya for review.

---
_Generated with Coder Agents._
@cjfit

cjfit commented Nov 6, 2026

Copy link
Copy Markdown
Contributor

NO FINDINGS — No reachable security defect introduced or materially worsened by this change was confirmed.

Reviewed base 4fe64af03b886b0f9897e9b41e0e51d5ede268ba → head 0dbcba48baccc9a9a762692111073de5451a8d7d.

  • Coverage: Compared all 10 changed workflows, checking event admission, job guards, checkout refs, credential consumers, token permissions, and publication steps. Checked the contribution jobs’ main-base restrictions (.github/workflows/contrib.yaml:30–35,103–107), exclusion of PR runs from the environment in the docs workflow (.github/workflows/weekly-docs.yaml:67), and the retained main-ref guard on CI notifications (.github/workflows/ci.yaml:1771). The eval workflow’s push-permission and fork checks still precede the credential-bearing job (.github/workflows/eval-coder-agents.yaml:89–94,116).
  • Environment: On November 6, 2026, GitHub’s environment and deployment-branch-policy APIs showed main restricted to the branch named main. This is current configuration evidence, not a claim about historical settings.
  • Verification: Read-only source comparison and configuration inspection; no workflows or repository code executed, and no secret values accessed. This verdict concerns incremental security risk, not operational validation of secret migration.

Generated by Coder Agents on behalf of @cjfit.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
cjfit
cjfit approved these changes Nov 6, 2026
View reviewed changes
@sreya
sreya merged commit eb61630 into main Nov 7, 2026
29 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@sreya
sreya deleted the ci/main-environment branch November 7, 2026 00:52
@sreya
sreya temporarily deployed to main November 7, 2026 00:52 — with GitHub Actions Inactive
@github-actions github-actions Bot locked and limited conversation to collaborators Nov 7, 2026

This branch was previously deployed

1 inactive deployment
main — 0dbcba48 Deployed Nov 7, 2026 by sreya via cla #252008
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@cjfit cjfit cjfit approved these changes
@nickvigilante nickvigilante Awaiting requested review from nickvigilante nickvigilante is a code owner
@jdomeracki-coder jdomeracki-coder Awaiting requested review from jdomeracki-coder jdomeracki-coder is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@sreya sreya

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@sreya @cjfit
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.