From 6fc9db90957f3705ff5dd563b1454d0d5a4c3fd8 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Wed, 28 Oct 2026 22:00:46 -0700 Subject: [PATCH 1/6] chore(quest): claim quest/m0/ci/read-only-secrets.md Quest-Claim: fdb79c17d6597672 From 22267868b9433b4de644782e4741bd549765b985 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Wed, 28 Oct 2026 22:08:13 -0700 Subject: [PATCH 2/6] ci: record release backport and remaining credential migration Keep the quest open for the maintainer-only tag policy, credential migration, publisher restrictions, and negative branch probe. Co-Authored-By: GPT-6.1 Sol --- quest/m0/ci/read-only-secrets.md | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/quest/m0/ci/read-only-secrets.md b/quest/m0/ci/read-only-secrets.md index af9e8a767c2..32514c625df 100644 --- a/quest/m0/ci/read-only-secrets.md +++ b/quest/m0/ci/read-only-secrets.md @@ -35,12 +35,23 @@ JSR's repository OIDC trust while the token is unset. The repository's `MBX_R2_*` pair is read-only: a branch's write to `mbx-moq-dev` is refused with AccessDenied. +Prepared in [moq-dev/moq#7202](https://github.com/moq-dev/moq/pull/7202): the +workflow backport to `release`, including its legacy Cachix publishers and +JSR token handling. It remains draft pending the tag-policy decision below. +No secrets or trusted publisher accounts have been changed. + What remains, in order. Deleting a repository-level secret earlier breaks a publish, since jobs that do not name `publish` still read it: -1. Backport the workflow changes to `release`. Release pushes and release - tags run `release`'s own copies of the workflows, which differ widely from - `main`'s. +1. Settle the legacy tag policy and land the backport. `publish` currently + admits `main`, `release`, and CLI, relay, and FFI tags, but `release`'s + Cachix publisher also handles `moq-boy-v*`, `moq-gst-v*`, and `libmoq-v*`. + Recommendation: preserve those publications by admitting these three tag + patterns to `publish` and protecting `libmoq-v*` creation, update, and + deletion in the `release tags` ruleset. The other two patterns are already + protected. Otherwise explicitly retire those legacy Cachix publications. + Release pushes and tags run `release`'s own workflow copies, so the backport + must land before repository credentials are removed. 2. The maintainer copies each value into the `publish` Environment: `CARGO_REGISTRY_TOKEN`, `CLOUDFLARE_API_TOKEN`, `DOCKER_USERNAME`, `DOCKER_PASSWORD`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`, @@ -50,7 +61,7 @@ publish, since jobs that do not name `publish` still read it: shadows the organization's) and `DISCORD_WEBHOOK`. 3. Then deletes those repository secrets, the unused ones (`GCP_SERVICE_ACCOUNT_KEY`, `CLAUDE_CODE_OAUTH_TOKEN`, - `META_MODEL_API_KEY`, `APP_ID`), and this repository's access to the + `META_MODEL_API_KEY`), and this repository's access to the organization's `APP_PRIVATE_KEY` and `DISCORD_WEBHOOK`. `APP_CLIENT_ID` and `APP_ID` are identifiers and can stay. `MBX_R2_*` stays. 4. The maintainer names the Environment in each trusted publisher: npm's From 46d0503f73331e281af2511a3d789630d28887f1 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 30 Oct 2026 23:34:08 -0700 Subject: [PATCH 3/6] quest: record the legacy release tag policy as done publish now admits moq-boy-v*, moq-gst-v*, and libmoq-v* tags, and the release tags ruleset covers libmoq-v*. The moq-bot key already moved into the bot and publish Environments, so drop it from the remaining copy and delete steps. Co-Authored-By: Claude Opus 5.5 --- quest/m0/ci/read-only-secrets.md | 28 ++++++++++++---------------- 1 file changed, 12 insertions(+), 16 deletions(-) diff --git a/quest/m0/ci/read-only-secrets.md b/quest/m0/ci/read-only-secrets.md index 3c3c98b4740..d7abff66802 100644 --- a/quest/m0/ci/read-only-secrets.md +++ b/quest/m0/ci/read-only-secrets.md @@ -37,33 +37,29 @@ with AccessDenied. Prepared in [moq-dev/moq#7202](https://github.com/moq-dev/moq/pull/7202): the workflow backport to `release`, including its legacy Cachix publishers and -JSR token handling. It remains draft pending the tag-policy decision below. -No secrets or trusted publisher accounts have been changed. +JSR token handling. Its moq-bot jobs name `bot`, as on `main`. + +Done 2026-10-31 for the backport's legacy Cachix publishers: `publish` also +admits `moq-boy-v*`, `moq-gst-v*`, and `libmoq-v*` tags, and the `release +tags` ruleset now also covers `libmoq-v*`. The moq-bot key +(`APP_CLIENT_ID`, `APP_PRIVATE_KEY`) already lives in `bot` and `publish`; +the repository's copy and its access to the organization's are gone. What remains, in order. Deleting a repository-level secret earlier breaks a publish, since jobs that do not name `publish` still read it: -1. Settle the legacy tag policy and land the backport. `publish` currently - admits `main`, `release`, and CLI, relay, and FFI tags, but `release`'s - Cachix publisher also handles `moq-boy-v*`, `moq-gst-v*`, and `libmoq-v*`. - Recommendation: preserve those publications by admitting these three tag - patterns to `publish` and protecting `libmoq-v*` creation, update, and - deletion in the `release tags` ruleset. The other two patterns are already - protected. Otherwise explicitly retire those legacy Cachix publications. - Release pushes and tags run `release`'s own workflow copies, so the backport - must land before repository credentials are removed. +1. Land the backport. Release pushes and tags run `release`'s own workflow + copies, so it must land before repository credentials are removed. 2. The maintainer copies each value into the `publish` Environment: `CARGO_REGISTRY_TOKEN`, `CLOUDFLARE_API_TOKEN`, `DOCKER_USERNAME`, `DOCKER_PASSWORD`, `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`, `SIGNING_KEY`, `SIGNING_PASSWORD`, `WINGET_TOKEN`, `R2_ACCESS_KEY_ID`, - `R2_SECRET_ACCESS_KEY`, `R2_ACCOUNT_ID`, `CACHIX_AUTH_TOKEN`, - `APP_PRIVATE_KEY` (the value jobs use today, the repository's, which - shadows the organization's) and `DISCORD_WEBHOOK`. + `R2_SECRET_ACCESS_KEY`, `R2_ACCOUNT_ID`, `CACHIX_AUTH_TOKEN` and + `DISCORD_WEBHOOK` (today the organization's). 3. Then deletes those repository secrets, the unused ones (`GCP_SERVICE_ACCOUNT_KEY`, `CLAUDE_CODE_OAUTH_TOKEN`, `META_MODEL_API_KEY`), and this repository's access to the - organization's `APP_PRIVATE_KEY` and `DISCORD_WEBHOOK`. `APP_CLIENT_ID` - and `APP_ID` are identifiers and can stay. `MBX_R2_*` stays. + organization's `DISCORD_WEBHOOK`. `MBX_R2_*` stays. 4. The maintainer names the Environment in each trusted publisher: npm's (`npm`, for every `@moq/*` package), PyPI's (`pypi`, for `moq-rs` and `moq-ffi`) and pub.dev's (`pub.dev`, for `moq` and `moq_ffi`). Until then a From d5a56eae3a747660bd7805f22c38f5322168ebaa Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Thu, 5 Nov 2026 13:26:46 -0800 Subject: [PATCH 4/6] quest(ci): retire Cachix instead of moving CACHIX_AUTH_TOKEN Record the maintainer's 2026-11-05 decision: the planned cachix-retire quest deletes CACHIX_AUTH_TOKEN, so this quest's deletions skip it and its final check waits for that quest. Co-Authored-By: Claude Opus 5.5 --- quest/m0/ci/read-only-secrets.md | 42 ++++++++++++++++---------------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/quest/m0/ci/read-only-secrets.md b/quest/m0/ci/read-only-secrets.md index c0a029157f2..2657e4a5c35 100644 --- a/quest/m0/ci/read-only-secrets.md +++ b/quest/m0/ci/read-only-secrets.md @@ -65,31 +65,27 @@ same name, so that run proves the release jobs read the Environment's copies, and proves `SIGNING_PASSWORD` if a Kotlin, apt, or rpm publish runs. Not chosen: deleting them now. -`CACHIX_AUTH_TOKEN` is not in `publish` and stays out of the deletions for -now: `release`'s `cachix.yml` still reads it on `moq-relay-v*`, -`moq-cli-v*`, `moq-boy-v*`, `libmoq-v*`, and `moq-gst-v*` tags. That job -names `publish`, so it falls back to the repository copy. (`release`'s -`cache.yml` also reads it but fires only on pushes to `main`, so it never -runs there.) `main` no longer uses Cachix, and -[nix-cache-verify](/quest/m0/ci/nix-cache-verify.md) deletes the token once -a release cut merges `main` into `release`. Until then a branch can still -read it, so the Goal's check fails on it unless it moves into `publish`. +Decided 2026-11-05 (maintainer, /quest-unblock): ✅ retire Cachix instead of +moving `CACHIX_AUTH_TOKEN`. `release`'s `cachix.yml` still reads it on +`moq-relay-v*`, `moq-cli-v*`, `moq-boy-v*`, `libmoq-v*`, and `moq-gst-v*` +tags; that job names `publish`, which lacks it, so it reads the repository +copy. (`release`'s `cache.yml` also reads it but fires only on pushes to +`main`, so it never runs there.) The m0 quest `cachix-retire`, planned in +[moq-dev/moq#7982](https://github.com/moq-dev/moq/pull/7982), backports +`release-nix.yml` to `release`, drops `cachix.yml` there, and deletes +`CACHIX_AUTH_TOKEN` and the `kixelated` cache once a release tag proves +nix.moq.dev. So the deletions here leave `CACHIX_AUTH_TOKEN` to that quest, +and the throwaway-branch check waits for it. Not chosen: copying it into +`publish` now; leaving it at repository scope until the m2 cut. The maintainer's steps are under Waiting, in order. Deleting a repository-level secret before a release proves the Environment copy breaks a -publish. Once they clear, an agent runs the throwaway-branch check in the -Goal, which also confirms each Environment refuses the branch, then deletes -the branch. +publish. Once they and `cachix-retire` clear, an agent runs the +throwaway-branch check in the Goal, which also confirms each Environment +refuses the branch, then deletes the branch. ## Waiting -- Maintainer: decide where `CACHIX_AUTH_TOKEN` lives until Cachix retires. - Recommended: copy it into `publish` now, beside the others, and delete the - repository copy with them; `release`'s `cachix.yml` already names - `publish`, and [publish-release-only](/quest/m0/ci/publish-release-only.md) - already expects to remove it from there. Alternative: leave it at - repository scope and hold the final check until - [nix-cache-verify](/quest/m0/ci/nix-cache-verify.md) deletes it. - Maintainer: once [moq-dev/moq#7936](https://github.com/moq-dev/moq/pull/7936)'s tags publish cleanly through `publish` (check every job in its tag runs with `gh run list --repo moq-dev/moq --branch `), delete the @@ -98,7 +94,7 @@ the branch. `META_MODEL_API_KEY`, and this repository's access to the organization's `DISCORD_WEBHOOK` (already in `alert`). `MBX_R2_*` stays. Agents must not change credentials. Check: `gh secret list --repo moq-dev/moq` lists only - `MBX_R2_*` (plus `CACHIX_AUTH_TOKEN` if it stays), and + `MBX_R2_*` and `CACHIX_AUTH_TOKEN` (until `cachix-retire` deletes it), and `gh api repos/moq-dev/moq/actions/organization-secrets` lists none. - Maintainer: name the Environment in each trusted publisher, which needs the registries' account logins: npm's (`npm`, for the 17 public `@moq/*` @@ -115,8 +111,12 @@ the branch. unlinking before the token exists pauses JSR publishing. Check: `gh secret list --repo moq-dev/moq --env npm` lists `JSR_TOKEN`, and each package's JSR settings show no linked repository. +- moq-dev/moq: [moq-dev/moq#7982](https://github.com/moq-dev/moq/pull/7982) + adds `/quest/m0/ci/cachix-retire.md` to `main`. Then merge `main` here and + replace this item with a `Required` link to it, since the throwaway-branch + check needs `CACHIX_AUTH_TOKEN` gone. Check: + `gh pr view 7982 --repo moq-dev/moq --json state`. ## Related - [Drop main from publish](/quest/m0/ci/publish-release-only.md) - narrows `publish` to `release` and release tags once `main` merges into `release` -- [Verify the Nix cache](/quest/m0/ci/nix-cache-verify.md) - retires Cachix and deletes `CACHIX_AUTH_TOKEN` From 92572c18d7a9dd038bcefb9e449c039ae5274753 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 6 Nov 2026 10:14:55 -0800 Subject: [PATCH 5/6] quest(ci): record 2026-11-06 publisher, JSR, and patch-cut checks Co-Authored-By: Claude Opus 5.5 --- quest/m0/ci/read-only-secrets.md | 96 +++++++++++++++++++++----------- 1 file changed, 65 insertions(+), 31 deletions(-) diff --git a/quest/m0/ci/read-only-secrets.md b/quest/m0/ci/read-only-secrets.md index 2657e4a5c35..273d9477c79 100644 --- a/quest/m0/ci/read-only-secrets.md +++ b/quest/m0/ci/read-only-secrets.md @@ -70,14 +70,51 @@ moving `CACHIX_AUTH_TOKEN`. `release`'s `cachix.yml` still reads it on `moq-relay-v*`, `moq-cli-v*`, `moq-boy-v*`, `libmoq-v*`, and `moq-gst-v*` tags; that job names `publish`, which lacks it, so it reads the repository copy. (`release`'s `cache.yml` also reads it but fires only on pushes to -`main`, so it never runs there.) The m0 quest `cachix-retire`, planned in -[moq-dev/moq#7982](https://github.com/moq-dev/moq/pull/7982), backports +`main`, so it never runs there.) The m0 quest [cachix-retire](/quest/m0/ci/cachix-retire.md), +from [moq-dev/moq#7982](https://github.com/moq-dev/moq/pull/7982), backports `release-nix.yml` to `release`, drops `cachix.yml` there, and deletes `CACHIX_AUTH_TOKEN` and the `kixelated` cache once a release tag proves nix.moq.dev. So the deletions here leave `CACHIX_AUTH_TOKEN` to that quest, and the throwaway-branch check waits for it. Not chosen: copying it into `publish` now; leaving it at repository scope until the m2 cut. +Done 2026-11-06 (maintainer, /quest-unblock): trusted publishers name +their Environment. npm: `npm` is set and verified on `@moq/net`, `auth`, +`boy`, `hang`, `json`, `loc`, `msf`, `pattern`, `publish`, and `room`; npm's +Cloudflare blocked the automated save for `@moq/watch` and `@moq/signals`, so +those two remain (under Waiting). `@moq/qmux` is published by +moq-dev/web-transport, so it is out of scope here; `@moq/clock`, `libav`, +`ui`, and `video` are not published yet, and +[npm-first-publish](/quest/m3/release/npm-first-publish.md) claims them with +the `npm` Environment. PyPI: `moq-rs` already required `pypi`, and `moq-ffi`'s +any-environment publisher was replaced by one requiring `pypi` (verified on +its settings page). pub.dev: the maintainer set the required environment +`pub.dev` on `moq` and `moq_ffi` and reported both pages show it; agents +cannot view pub.dev admin pages. + +Decided 2026-11-06 (maintainer, /quest-unblock): ✅ drop JSR rather than +create a `JSR_TOKEN`. The new m0 quest `jsr-retire`, planned in +[moq-dev/moq#8039](https://github.com/moq-dev/moq/pull/8039), owns removing +JSR publishing and its repository OIDC trust, so this quest no longer +creates a token or unlinks packages. Not chosen: keeping JSR behind a +`JSR_TOKEN` in the `npm` Environment. + +Checked 2026-11-06: 3 of [moq-dev/moq#7936](https://github.com/moq-dev/moq/pull/7936)'s +14 tag runs failed on their first attempt. Cachix `moq-relay-v0.17.13` +([run 42129037703](https://github.com/moq-dev/moq/actions/runs/42129037703)): +the macOS and aarch64-linux jobs, both started 23:23:25Z, failed with +"Unable to fetch the information for the environment 'publish' targeted by +this job", while the ubuntu job in the same run, started 41 seconds later, +passed through `publish`. `publish`'s deployment policy admits +`moq-relay-v*` tags (with `main`, `release`, and the `libmoq`, `moq-boy`, +`moq-cli`, `moq-ffi`, and `moq-gst` tag patterns), so this was a transient +GitHub API failure, not a policy gap. Cachix `moq-gst-v0.4.23` +([run 42129724193](https://github.com/moq-dev/moq/actions/runs/42129724193)) +hit a network fetch failure, and moq-gst `moq-gst-v0.4.23` +([run 42129723974](https://github.com/moq-dev/moq/actions/runs/42129723974)) +timed out in `brew test` on the aarch64-apple-darwin tarball, which skipped +its Release job. None of the three points at the Environment's secrets. + The maintainer's steps are under Waiting, in order. Deleting a repository-level secret before a release proves the Environment copy breaks a publish. Once they and `cachix-retire` clear, an agent runs the @@ -86,36 +123,33 @@ refuses the branch, then deletes the branch. ## Waiting -- Maintainer: once [moq-dev/moq#7936](https://github.com/moq-dev/moq/pull/7936)'s - tags publish cleanly through `publish` (check every job in its tag runs - with `gh run list --repo moq-dev/moq --branch `), delete the - repository copies of the twelve secrets above, the unused - `GCP_SERVICE_ACCOUNT_KEY`, `CLAUDE_CODE_OAUTH_TOKEN`, and - `META_MODEL_API_KEY`, and this repository's access to the organization's - `DISCORD_WEBHOOK` (already in `alert`). `MBX_R2_*` stays. Agents must not - change credentials. Check: `gh secret list --repo moq-dev/moq` lists only - `MBX_R2_*` and `CACHIX_AUTH_TOKEN` (until `cachix-retire` deletes it), and +- Maintainer: re-run the failed jobs of the three + [moq-dev/moq#7936](https://github.com/moq-dev/moq/pull/7936) tag runs + ([42129037703](https://github.com/moq-dev/moq/actions/runs/42129037703), + [42129724193](https://github.com/moq-dev/moq/actions/runs/42129724193), + [42129723974](https://github.com/moq-dev/moq/actions/runs/42129723974)); + the Plan's 2026-11-06 check found each failure transient or unrelated to + `publish`. Once every job passes, delete the repository copies of the + twelve secrets above, the unused `GCP_SERVICE_ACCOUNT_KEY`, + `CLAUDE_CODE_OAUTH_TOKEN`, and `META_MODEL_API_KEY`, and this repository's + access to the organization's `DISCORD_WEBHOOK` (already in `alert`). + `MBX_R2_*` stays. Agents must not change credentials or re-run workflows. + Check: `gh run view --repo moq-dev/moq` shows every job passed; + `gh secret list --repo moq-dev/moq` lists only `MBX_R2_*` and + `CACHIX_AUTH_TOKEN` (until `cachix-retire` deletes it); and `gh api repos/moq-dev/moq/actions/organization-secrets` lists none. -- Maintainer: name the Environment in each trusted publisher, which needs - the registries' account logins: npm's (`npm`, for the 17 public `@moq/*` - packages), PyPI's (`pypi`, for `moq-rs` and `moq-ffi`), and pub.dev's - (`pub.dev`, for `moq` and `moq_ffi`). Until then a branch can still claim - their OIDC identity by copying the workflow file. Started in the browser - 2026-11-05 and paused at the npm login. Check each publisher's settings - page shows its Environment. -- Maintainer: after the npm step, create a JSR publish token for the `@moq` - scope and add it as `JSR_TOKEN` in the `npm` Environment, then unlink the - GitHub repository from each JSR package (`@moq/auth`, `clock`, `hang`, - `json`, `loc`, `msf`, `net`, `pattern`, `qmux`, `room`, `signals`, - `video`), since JSR cannot require an Environment. Needs the JSR account; - unlinking before the token exists pauses JSR publishing. Check: - `gh secret list --repo moq-dev/moq --env npm` lists `JSR_TOKEN`, and each - package's JSR settings show no linked repository. -- moq-dev/moq: [moq-dev/moq#7982](https://github.com/moq-dev/moq/pull/7982) - adds `/quest/m0/ci/cachix-retire.md` to `main`. Then merge `main` here and - replace this item with a `Required` link to it, since the throwaway-branch - check needs `CACHIX_AUTH_TOKEN` gone. Check: - `gh pr view 7982 --repo moq-dev/moq --json state`. +- Maintainer: on npm, set the trusted publisher's Environment for + `@moq/watch` and `@moq/signals` (Settings, Trusted Publisher, Edit, + Environment `npm`); Cloudflare blocked the automated save. Check: each + package's Trusted Publisher settings show Environment `npm`. +- moq-dev/moq: [moq-dev/moq#8039](https://github.com/moq-dev/moq/pull/8039) + adds `/quest/m0/ci/jsr-retire.md` to `main`. Then merge `main` here and + link it under Related as the owner of JSR. Check: + `gh pr view 8039 --repo moq-dev/moq --json state`. + +## Required + +- [Retire Cachix](/quest/m0/ci/cachix-retire.md) - deletes `CACHIX_AUTH_TOKEN`, which the throwaway-branch check needs gone ## Related From 0936fc14c9937b8b522ae6822fe3e2dea86e2a39 Mon Sep 17 00:00:00 2001 From: Luke Curley Date: Fri, 6 Nov 2026 15:17:08 -0800 Subject: [PATCH 6/6] quest: record the 2026-11-06 secret deletions and drop Pullfrog's provider keys Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pullfrog.yml | 43 ++------------------ quest/m0/ci/read-only-secrets.md | 70 +++++++++++++++----------------- 2 files changed, 37 insertions(+), 76 deletions(-) diff --git a/.github/workflows/pullfrog.yml b/.github/workflows/pullfrog.yml index f698e046c9b..b5e67425744 100644 --- a/.github/workflows/pullfrog.yml +++ b/.github/workflows/pullfrog.yml @@ -17,8 +17,8 @@ permissions: jobs: pullfrog: runs-on: ubuntu-latest - # Provider secrets live in this environment, which only main may deploy to, - # so a dispatch on a pushed branch can't reach them. + # Only main may deploy to this environment, so a dispatch on a pushed + # branch can't mint the OIDC token Pullfrog trades for model access. environment: pullfrog permissions: id-token: write @@ -33,40 +33,5 @@ jobs: uses: pullfrog/pullfrog@895164fc90f5c493e72693c919c6cf269af158eb # v0.1.110 with: prompt: ${{ inputs.prompt }} - env: - # add at least one provider API key - CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }} - META_MODEL_API_KEY: ${{ secrets.META_MODEL_API_KEY }} - - # for Amazon Bedrock (https://docs.pullfrog.com/bedrock) - # AWS_BEARER_TOKEN_BEDROCK: ${{ secrets.AWS_BEARER_TOKEN_BEDROCK }} - # AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }} - # AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }} - # AWS_REGION: us-east-1 - # BEDROCK_MODEL_ID: - - # for Google Vertex AI (https://docs.pullfrog.com/vertex) - # VERTEX_SERVICE_ACCOUNT_JSON: >- - # ${{ secrets.VERTEX_SERVICE_ACCOUNT_JSON }} - # GOOGLE_CLOUD_PROJECT: my-project - # VERTEX_LOCATION: global - # VERTEX_MODEL_ID: - - # for Azure OpenAI (https://docs.pullfrog.com/azure) - # AZURE_RESOURCE_NAME is the in https://.openai.azure.com - # AZURE_DEPLOYMENT is your deployment's name, not the model it serves - # AZURE_RESOURCE_NAME: my-resource - # AZURE_API_KEY: ${{ secrets.AZURE_API_KEY }} - # AZURE_DEPLOYMENT: - # both limits are required - set them to the real limits of that model - # AZURE_CONTEXT: "400000" - # AZURE_MAX_OUTPUT: "128000" - - # for any OpenAI-compatible endpoint - LiteLLM, Cloudflare AI Gateway, - # self-hosted vLLM (https://docs.pullfrog.com/openai-compatible) - # OPENAI_COMPATIBLE_BASE_URL: https://litellm.example.com/v1 - # OPENAI_COMPATIBLE_API_KEY: ${{ secrets.OPENAI_COMPATIBLE_API_KEY }} - # OPENAI_COMPATIBLE_MODEL: - # both limits are required - set them to the real limits of that model - # OPENAI_COMPATIBLE_CONTEXT: "128000" - # OPENAI_COMPATIBLE_MAX_OUTPUT: "16384" + # No provider keys from this repository: model access is configured + # in the Pullfrog console (https://docs.pullfrog.com/model-access). diff --git a/quest/m0/ci/read-only-secrets.md b/quest/m0/ci/read-only-secrets.md index 273d9477c79..de4c4d0c20d 100644 --- a/quest/m0/ci/read-only-secrets.md +++ b/quest/m0/ci/read-only-secrets.md @@ -54,8 +54,7 @@ Done 2026-11-05 (maintainer, /quest-unblock): `publish` holds `dev.moq:moq` 0.5.3 and `moq-ffi` 0.4.22 on Maven Central; `WINGET_TOKEN` is a fresh classic PAT owned by kixelated with only `public_repo`, which holds the microsoft/winget-pkgs fork; the R2 pair lists both `apt-moq-dev` and -`rpm-moq-dev`. `SIGNING_PASSWORD` was not tested against the key. The -repository-level copies are still present. +`rpm-moq-dev`. `SIGNING_PASSWORD` was not tested against the key. Decided 2026-11-05 (maintainer, /quest-unblock): ✅ delete the repository copies only after the next combined patch cut on `release` (release-plz PR @@ -80,9 +79,9 @@ and the throwaway-branch check waits for it. Not chosen: copying it into Done 2026-11-06 (maintainer, /quest-unblock): trusted publishers name their Environment. npm: `npm` is set and verified on `@moq/net`, `auth`, -`boy`, `hang`, `json`, `loc`, `msf`, `pattern`, `publish`, and `room`; npm's -Cloudflare blocked the automated save for `@moq/watch` and `@moq/signals`, so -those two remain (under Waiting). `@moq/qmux` is published by +`boy`, `hang`, `json`, `loc`, `msf`, `pattern`, `publish`, `room`, `watch`, +and `signals` (the last two by hand, since npm's Cloudflare blocked the +automated save). `@moq/qmux` is published by moq-dev/web-transport, so it is out of scope here; `@moq/clock`, `libav`, `ui`, and `video` are not published yet, and [npm-first-publish](/quest/m3/release/npm-first-publish.md) claims them with @@ -93,8 +92,8 @@ its settings page). pub.dev: the maintainer set the required environment cannot view pub.dev admin pages. Decided 2026-11-06 (maintainer, /quest-unblock): ✅ drop JSR rather than -create a `JSR_TOKEN`. The new m0 quest `jsr-retire`, planned in -[moq-dev/moq#8039](https://github.com/moq-dev/moq/pull/8039), owns removing +create a `JSR_TOKEN`. The m0 quest [jsr-retire](/quest/m0/ci/jsr-retire.md), +from [moq-dev/moq#8039](https://github.com/moq-dev/moq/pull/8039), owns removing JSR publishing and its repository OIDC trust, so this quest no longer creates a token or unlinks packages. Not chosen: keeping JSR behind a `JSR_TOKEN` in the `npm` Environment. @@ -115,37 +114,33 @@ hit a network fetch failure, and moq-gst `moq-gst-v0.4.23` timed out in `brew test` on the aarch64-apple-darwin tarball, which skipped its Release job. None of the three points at the Environment's secrets. -The maintainer's steps are under Waiting, in order. Deleting a -repository-level secret before a release proves the Environment copy breaks a -publish. Once they and `cachix-retire` clear, an agent runs the +Done 2026-11-06 (maintainer, /quest-unblock): the three failed tag runs +were re-run; Cachix for `moq-relay-v0.17.13` and `moq-gst-v0.4.23` passed, +and the moq-gst macOS `brew test` hang is unrelated to secrets (planned in +[moq-dev/moq#8076](https://github.com/moq-dev/moq/pull/8076)). After +checking that every job on `main` and `release` reads them through `publish` +or gates the step to tags, the maintainer deleted 15 repository secrets: the +twelve `publish` secrets above, the unreferenced `GCP_SERVICE_ACCOUNT_KEY`, +and Pullfrog's `CLAUDE_CODE_OAUTH_TOKEN` and `META_MODEL_API_KEY`. The +repository secrets left are `CACHIX_AUTH_TOKEN` (owned by `cachix-retire`) +and the read-only `MBX_R2_ACCESS_KEY_ID` and `MBX_R2_SECRET_ACCESS_KEY`. + +Decided 2026-11-06 (maintainer, /quest-unblock): ✅ Pullfrog gets no +provider keys from this repository, so `pullfrog.yml` passes none; its +model access comes from the Pullfrog console, which the action reaches with +the job's OIDC token through the `pullfrog` Environment (main only). Not +chosen: moving the keys into the `pullfrog` Environment. + +Decided 2026-11-06 (maintainer, /quest-unblock): ✅ leave the organization +secret `DISCORD_WEBHOOK` visible to all repositories; this repository's +`alert` job reads the `alert` Environment's copy. Not chosen: narrowing it to +selected repositories. + +Once `cachix-retire` deletes `CACHIX_AUTH_TOKEN`, an agent runs the throwaway-branch check in the Goal, which also confirms each Environment -refuses the branch, then deletes the branch. - -## Waiting - -- Maintainer: re-run the failed jobs of the three - [moq-dev/moq#7936](https://github.com/moq-dev/moq/pull/7936) tag runs - ([42129037703](https://github.com/moq-dev/moq/actions/runs/42129037703), - [42129724193](https://github.com/moq-dev/moq/actions/runs/42129724193), - [42129723974](https://github.com/moq-dev/moq/actions/runs/42129723974)); - the Plan's 2026-11-06 check found each failure transient or unrelated to - `publish`. Once every job passes, delete the repository copies of the - twelve secrets above, the unused `GCP_SERVICE_ACCOUNT_KEY`, - `CLAUDE_CODE_OAUTH_TOKEN`, and `META_MODEL_API_KEY`, and this repository's - access to the organization's `DISCORD_WEBHOOK` (already in `alert`). - `MBX_R2_*` stays. Agents must not change credentials or re-run workflows. - Check: `gh run view --repo moq-dev/moq` shows every job passed; - `gh secret list --repo moq-dev/moq` lists only `MBX_R2_*` and - `CACHIX_AUTH_TOKEN` (until `cachix-retire` deletes it); and - `gh api repos/moq-dev/moq/actions/organization-secrets` lists none. -- Maintainer: on npm, set the trusted publisher's Environment for - `@moq/watch` and `@moq/signals` (Settings, Trusted Publisher, Edit, - Environment `npm`); Cloudflare blocked the automated save. Check: each - package's Trusted Publisher settings show Environment `npm`. -- moq-dev/moq: [moq-dev/moq#8039](https://github.com/moq-dev/moq/pull/8039) - adds `/quest/m0/ci/jsr-retire.md` to `main`. Then merge `main` here and - link it under Related as the owner of JSR. Check: - `gh pr view 8039 --repo moq-dev/moq --json state`. +refuses the branch, then deletes the branch. The branch may still see +`MBX_R2_*` and `DISCORD_WEBHOOK`, by the decisions above; any other secret +fails the check. ## Required @@ -153,4 +148,5 @@ refuses the branch, then deletes the branch. ## Related +- [Stop publishing to JSR](/quest/m0/ci/jsr-retire.md) - removes JSR publishing and its repository OIDC trust, so no `JSR_TOKEN` is created - [Drop main from publish](/quest/m0/ci/publish-release-only.md) - narrows `publish` to `release` and release tags once `main` merges into `release`