SRE-924: Mint the release token from a Vault-held key by TimDiekmann · Pull Request #9167 · hashintel/hash

TimDiekmann · 2026-08-05T16:45:52Z

🌟 What is the purpose of this PR?

The release job read a GitHub App's private key out of the legacy Vault and
minted an installation token with no repository scope, using an App that also
carries workflows: write. It now signs as a dedicated release App whose key
never leaves Vault, and the token it gets is scoped to this repository.

🔗 Related links

SRE-924: Sign the Renovate App JWT in Vault .github#95 — the composite action this uses
hashintel/internal-infra#321 — the transit mount, key and role (internal)

🚫 Blocked by

SRE-924: Sign the Renovate App JWT in Vault .github#95, because the action is pinned to a commit on that branch

🔍 What does this change?

release.yml drops the vault-action secret read and create-github-app-token
in favour of hashintel/.github/.github/actions/github-app-token, which has
Vault sign the App JWT
the job now declares environment: main, which is what resolves the production
Vault address, and puts the environment claim in the OIDC token so the Vault
role can bind it
authenticates as the hash-release App (four permissions) rather than
hash-worker (nine)

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

do not affect the execution graph

⚠️ Known issues

The action is pinned to an unmerged commit of hashintel/.github#95, marked in
place with # unmerged — re-pin to main. It has to be re-pinned once that PR
merges, and this PR must not merge before then.

🐾 Next steps

Once a release run is green, the App key can be revoked in the App settings.

🛡 What tests cover this?

None automated. The JWT assembly was verified against the GitHub API, and the
imported key was verified byte-for-byte against its PEM.

❓ How to test this?

Merge SRE-924: Sign the Renovate App JWT in Vault .github#95 and re-pin the action to main
Push to main
Confirm the release job obtains a token and changesets runs; a mismatched role,
claim or key fails visibly at the Vault login or the App JWT exchange

vercel · 2026-08-05T16:45:59Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 6, 2026 9:01am
hashdotdesign-tokens	Ready	Preview	Aug 6, 2026 9:01am
petrinaut	Ready	Preview	Aug 6, 2026 9:01am

cursor · 2026-08-05T16:46:04Z

PR Summary

High Risk
Changes how release automation authenticates to GitHub and Vault; a misconfigured role, claim, or key would block releases or weaken token scope.

Overview
The release workflow no longer pulls a GitHub App private key from legacy Vault and mints a token with create-github-app-token. It now uses the shared github-app-token composite action, which authenticates to production Vault and signs the App JWT with a transit key so the release App key never leaves Vault.

The job adds environment: main so production Vault vars resolve and OIDC can bind the ci-hash-release role. Token minting switches from the broad hash-worker App to the dedicated hash-release App (4497272), with repository scoping and Cloudflare Access headers for Vault. The action is pinned to an unmerged commit until hashintel/.github#95 lands and must be re-pinned before merge.

^{Reviewed by Cursor Bugbot for commit 7dc0581. Bugbot is set up for automated code reviews on this repo. Configure here.}

Copilot

Pull request overview

Moves release-token minting to a dedicated GitHub App whose key remains in Vault.

Changes:

Uses the shared Vault-backed token action.
Scopes production Vault access through the main environment.
Removes direct private-key retrieval.

codspeed-hq · 2026-08-05T16:54:13Z

Merging this PR will not alter performance

✅ 98 untouched benchmarks

_{Comparing t/sre-924-sign-the-github-app-jwt-with-vault-transit-instead-of (7dc0581) with main (23c6a51)}

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

github-actions · 2026-08-05T20:09:37Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$28.1 \mathrm{ms} \pm 222 \mathrm{μs}\left({\color{gray}-0.286 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.48 \mathrm{ms} \pm 23.1 \mathrm{μs}\left({\color{gray}0.415 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$13.1 \mathrm{ms} \pm 116 \mathrm{μs}\left({\color{gray}1.09 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$44.3 \mathrm{ms} \pm 504 \mathrm{μs}\left({\color{gray}1.21 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$14.4 \mathrm{ms} \pm 132 \mathrm{μs}\left({\color{gray}-0.009 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$24.7 \mathrm{ms} \pm 202 \mathrm{μs}\left({\color{gray}0.049 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$29.1 \mathrm{ms} \pm 226 \mathrm{μs}\left({\color{gray}-0.564 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.81 \mathrm{ms} \pm 25.2 \mathrm{μs}\left({\color{gray}0.697 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$14.1 \mathrm{ms} \pm 114 \mathrm{μs}\left({\color{gray}0.628 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.83 \mathrm{ms} \pm 24.5 \mathrm{μs}\left({\color{gray}0.178 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.07 \mathrm{ms} \pm 20.8 \mathrm{μs}\left({\color{gray}0.901 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.38 \mathrm{ms} \pm 19.4 \mathrm{μs}\left({\color{gray}-1.006 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.24 \mathrm{ms} \pm 30.0 \mathrm{μs}\left({\color{gray}-0.448 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.54 \mathrm{ms} \pm 17.7 \mathrm{μs}\left({\color{gray}-1.253 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.18 \mathrm{ms} \pm 27.9 \mathrm{μs}\left({\color{gray}-0.177 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.48 \mathrm{ms} \pm 39.6 \mathrm{μs}\left({\color{gray}-0.371 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.47 \mathrm{ms} \pm 17.3 \mathrm{μs}\left({\color{gray}-0.704 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.13 \mathrm{ms} \pm 24.7 \mathrm{μs}\left({\color{gray}-1.404 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.63 \mathrm{ms} \pm 14.6 \mathrm{μs}\left({\color{gray}-2.999 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.53 \mathrm{ms} \pm 13.4 \mathrm{μs}\left({\color{gray}0.118 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.58 \mathrm{ms} \pm 13.0 \mathrm{μs}\left({\color{gray}-3.275 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.90 \mathrm{ms} \pm 19.9 \mathrm{μs}\left({\color{gray}-1.025 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.66 \mathrm{ms} \pm 16.1 \mathrm{μs}\left({\color{gray}-2.934 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.84 \mathrm{ms} \pm 15.0 \mathrm{μs}\left({\color{gray}-2.961 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.06 \mathrm{ms} \pm 19.7 \mathrm{μs}\left({\color{gray}-0.555 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.79 \mathrm{ms} \pm 16.8 \mathrm{μs}\left({\color{gray}0.940 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$3.02 \mathrm{ms} \pm 16.7 \mathrm{μs}\left({\color{gray}0.245 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.46 \mathrm{ms} \pm 25.8 \mathrm{μs}\left({\color{gray}0.271 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.01 \mathrm{ms} \pm 16.7 \mathrm{μs}\left({\color{gray}-0.267 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.32 \mathrm{ms} \pm 18.5 \mathrm{μs}\left({\color{gray}-0.615 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.41 \mathrm{ms} \pm 20.0 \mathrm{μs}\left({\color{gray}0.390 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.97 \mathrm{ms} \pm 14.0 \mathrm{μs}\left({\color{gray}-0.081 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.35 \mathrm{ms} \pm 17.0 \mathrm{μs}\left({\color{gray}0.389 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$43.5 \mathrm{ms} \pm 273 \mathrm{μs}\left({\color{gray}0.818 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$34.6 \mathrm{ms} \pm 199 \mathrm{μs}\left({\color{gray}3.10 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$37.6 \mathrm{ms} \pm 220 \mathrm{μs}\left({\color{gray}3.51 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$39.8 \mathrm{ms} \pm 1.28 \mathrm{ms}\left({\color{red}22.8 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$43.7 \mathrm{ms} \pm 263 \mathrm{μs}\left({\color{gray}1.26 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$50.9 \mathrm{ms} \pm 378 \mathrm{μs}\left({\color{gray}1.18 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$41.3 \mathrm{ms} \pm 262 \mathrm{μs}\left({\color{gray}0.461 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$93.0 \mathrm{ms} \pm 513 \mathrm{μs}\left({\color{gray}0.271 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$34.7 \mathrm{ms} \pm 224 \mathrm{μs}\left({\color{gray}1.25 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$262 \mathrm{ms} \pm 968 \mathrm{μs}\left({\color{lightgreen}-14.165 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$11.2 \mathrm{ms} \pm 69.4 \mathrm{μs}\left({\color{gray}-0.130 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$11.3 \mathrm{ms} \pm 72.6 \mathrm{μs}\left({\color{gray}0.318 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$11.3 \mathrm{ms} \pm 64.4 \mathrm{μs}\left({\color{gray}1.11 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$11.3 \mathrm{ms} \pm 92.7 \mathrm{μs}\left({\color{gray}1.43 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$11.2 \mathrm{ms} \pm 55.5 \mathrm{μs}\left({\color{gray}-0.597 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$11.2 \mathrm{ms} \pm 68.3 \mathrm{μs}\left({\color{gray}-0.004 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$11.3 \mathrm{ms} \pm 69.5 \mathrm{μs}\left({\color{gray}0.112 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$11.4 \mathrm{ms} \pm 81.2 \mathrm{μs}\left({\color{gray}1.52 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$11.4 \mathrm{ms} \pm 68.4 \mathrm{μs}\left({\color{gray}-0.319 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$11.5 \mathrm{ms} \pm 72.2 \mathrm{μs}\left({\color{gray}-0.436 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$11.7 \mathrm{ms} \pm 62.7 \mathrm{μs}\left({\color{gray}-1.090 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$11.8 \mathrm{ms} \pm 56.6 \mathrm{μs}\left({\color{gray}-0.139 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$11.7 \mathrm{ms} \pm 53.2 \mathrm{μs}\left({\color{gray}-0.484 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$11.8 \mathrm{ms} \pm 74.4 \mathrm{μs}\left({\color{gray}0.702 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$11.9 \mathrm{ms} \pm 74.1 \mathrm{μs}\left({\color{gray}-1.753 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$12.1 \mathrm{ms} \pm 101 \mathrm{μs}\left({\color{gray}2.98 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$11.8 \mathrm{ms} \pm 77.7 \mathrm{μs}\left({\color{gray}0.494 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$11.8 \mathrm{ms} \pm 64.1 \mathrm{μs}\left({\color{gray}-0.061 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$12.0 \mathrm{ms} \pm 98.1 \mathrm{μs}\left({\color{gray}2.08 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$8.80 \mathrm{ms} \pm 50.9 \mathrm{μs}\left({\color{gray}-0.276 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$61.8 \mathrm{ms} \pm 482 \mathrm{μs}\left({\color{gray}-1.199 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$117 \mathrm{ms} \pm 674 \mathrm{μs}\left({\color{gray}1.21 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$69.8 \mathrm{ms} \pm 617 \mathrm{μs}\left({\color{gray}0.679 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$82.1 \mathrm{ms} \pm 516 \mathrm{μs}\left({\color{gray}3.76 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$91.3 \mathrm{ms} \pm 694 \mathrm{μs}\left({\color{gray}3.49 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$94.6 \mathrm{ms} \pm 564 \mathrm{μs}\left({\color{gray}0.807 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$45.4 \mathrm{ms} \pm 273 \mathrm{μs}\left({\color{gray}-0.399 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$74.3 \mathrm{ms} \pm 440 \mathrm{μs}\left({\color{gray}0.839 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$51.3 \mathrm{ms} \pm 317 \mathrm{μs}\left({\color{gray}-0.622 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$61.2 \mathrm{ms} \pm 429 \mathrm{μs}\left({\color{gray}0.441 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$63.8 \mathrm{ms} \pm 518 \mathrm{μs}\left({\color{gray}0.327 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$63.5 \mathrm{ms} \pm 476 \mathrm{μs}\left({\color{gray}-0.078 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$123 \mathrm{ms} \pm 733 \mathrm{μs}\left({\color{gray}-0.783 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$134 \mathrm{ms} \pm 639 \mathrm{μs}\left({\color{gray}-2.183 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$19.6 \mathrm{ms} \pm 108 \mathrm{μs}\left({\color{gray}-0.840 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$543 \mathrm{ms} \pm 1.35 \mathrm{ms}\left({\color{gray}-1.663 \mathrm{\%}}\right) $$	Flame Graph

The release job read the App key from the legacy Vault's `dev` role and minted a token with no repository scope, so it could write to every repository the installation covers, using an App that also carries `workflows: write`. It now signs with the hash-release App, whose four permissions are what changesets actually needs, and the token is scoped to this repository. Declaring `environment: main` is what resolves the production Vault, and it puts the environment claim in the OIDC token for the role to bind.

The action no longer defaults it, so the caller says which repository the installation token may reach.

Copilot AI balanced review requested due to automatic review settings August 5, 2026 16:45

graphite-app Bot assigned TimDiekmann Aug 5, 2026

github-actions Bot added the area/infra Relates to version control, CI, CD or IaC (area) label Aug 5, 2026

TimDiekmann temporarily deployed to pull-request August 5, 2026 16:46 — with GitHub Actions Inactive

Copilot started reviewing on behalf of TimDiekmann August 5, 2026 16:46 View session

Copilot AI reviewed Aug 5, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

Copilot AI review requested due to automatic review settings August 5, 2026 16:53

Copilot started reviewing on behalf of TimDiekmann August 5, 2026 16:54 View session

TimDiekmann temporarily deployed to pull-request August 5, 2026 16:55 — with GitHub Actions Inactive

Copilot AI reviewed Aug 5, 2026

View reviewed changes

vercel Bot deployed to Preview – hashdotdesign-tokens August 5, 2026 16:56 View deployment

vercel Bot deployed to Preview – petrinaut August 5, 2026 16:58 View deployment

vercel Bot deployed to Preview – hash August 5, 2026 17:13 View deployment

Copilot AI review requested due to automatic review settings August 5, 2026 18:49

Copilot started reviewing on behalf of TimDiekmann August 5, 2026 18:50 View session

TimDiekmann temporarily deployed to pull-request August 5, 2026 18:50 — with GitHub Actions Inactive

Copilot AI reviewed Aug 5, 2026

View reviewed changes

vercel Bot deployed to Preview – hashdotdesign-tokens August 5, 2026 18:52 View deployment

vercel Bot deployed to Preview – petrinaut August 5, 2026 18:54 View deployment

vercel Bot deployed to Preview – hash August 5, 2026 19:07 View deployment

Base automatically changed from t/sre-915-narrow-vault-dev-role-housekeeping-workflow to main August 6, 2026 08:24

TimDiekmann added 2 commits August 6, 2026 10:52

SRE-924: Name the repository the token is scoped to

e0637e8

The action no longer defaults it, so the caller says which repository the installation token may reach.

SRE-924: Say the pin returns to a SHA, not to @main

7dc0581

TimDiekmann force-pushed the t/sre-924-sign-the-github-app-jwt-with-vault-transit-instead-of branch from b4ebf17 to 7dc0581 Compare August 6, 2026 08:52

TimDiekmann deployed to pull-request August 6, 2026 08:53 — with GitHub Actions Active

TimDiekmann temporarily deployed to pull-request August 6, 2026 08:53 — with GitHub Actions Inactive

vercel Bot deployed to Preview – hashdotdesign-tokens August 6, 2026 08:54 View deployment

vercel Bot deployed to Preview – petrinaut August 6, 2026 08:57 View deployment

vercel Bot deployed to Preview – hash August 6, 2026 09:01 View deployment

Navigation Menu

Uh oh!

SRE-924: Mint the release token from a Vault-held key - #9167

SRE-924: Mint the release token from a Vault-held key#9167
TimDiekmann wants to merge 3 commits into
mainfrom
t/sre-924-sign-the-github-app-jwt-with-vault-transit-instead-of

TimDiekmann commented Aug 5, 2026

Uh oh!

vercel Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

codspeed-hq Bot commented Aug 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions Bot commented Aug 5, 2026

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

TimDiekmann commented Aug 5, 2026

🌟 What is the purpose of this PR?

🔗 Related links

🚫 Blocked by

🔍 What does this change?

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

📜 Does this require a change to the docs?

🕸️ Does this require a change to the Turbo Graph?

⚠️ Known issues

🐾 Next steps

🛡 What tests cover this?

❓ How to test this?

Uh oh!

vercel Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

codspeed-hq Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

github-actions Bot commented Aug 5, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Aug 5, 2026 •

edited

Loading

cursor Bot commented Aug 5, 2026 •

edited

Loading

codspeed-hq Bot commented Aug 5, 2026 •

edited

Loading