SRE-915: Split the App private key out of the Renovate job (not viable) - #94
Closed
TimDiekmann wants to merge 1 commit into
Closed
SRE-915: Split the App private key out of the Renovate job (not viable)#94TimDiekmann wants to merge 1 commit into
TimDiekmann wants to merge 1 commit into
Conversation
One job mints the installation token, the other installs and runs Renovate with needs. The second holds no id-token: write and never sees the private key, so code executing during npm ci or inside Renovate can take an hour-long token scoped to one repo rather than a permanent key covering the whole installation. Every step in the minting job is a SHA-pinned third-party action or an inline run. A local uses: ./... would resolve from the caller's checked-out tree, which any token with contents: write can rewrite, and that would put attacker code back into the privileged job. Job outputs are not masked like secrets, so the consuming job re-registers the token before anything else runs.
TimDiekmann
changed the title
TimDiekmann
deleted the
t/sre-915-narrow-vault-dev-role-housekeeping-workflow
branch
August 5, 2026 12:05
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🌟 What is the purpose of this PR?
Closed unmerged — the approach cannot work.
create-github-app-tokenregisters the token withcore.setSecret, and the runner drops job outputs whose value matches a registered secret:The consuming job received an empty
RENOVATE_TOKENand Renovate exited with "You must configure a GitHub token". A secret cannot be handed between jobs this way, and the alternatives — a shared symmetric key, or an artifact — are both worse than the problem.Superseded by the transit-signing approach: Vault holds the App key as a non-exportable transit key and only signs the App JWT, so the key never enters CI at all. Tracked in Linear.
The original intent was to split the Renovate workflow into two jobs so the job running
npm ciand Renovate would not hold the GitHub App private key.🔗 Related links
🔍 What was learned
vault-actioncallscore.setSecreton every retrieved value regardless ofexportEnv, so a payload reading the runner's own memory recovers the key either way. Every mitigation at the workflow-configuration layer shares that limit.