SRE-924: Mint the release token from a Vault-held key by TimDiekmann · Pull Request #9167 · hashintel/hash

TimDiekmann · 2026-08-05T16:45:52Z

🌟 What is the purpose of this PR?

The release job read a GitHub App's private key out of the legacy Vault and
minted an installation token with no repository scope, using an App that also
carries workflows: write. It now signs as a dedicated release App whose key
never leaves Vault, and the token it gets is scoped to this repository.

🔗 Related links

SRE-924: Sign the Renovate App JWT in Vault .github#95 — the composite action this uses
hashintel/internal-infra#321 — the transit mount, key and role (internal)

🚫 Blocked by

SRE-924: Sign the Renovate App JWT in Vault .github#95, because the action is pinned to a commit on that branch

🔍 What does this change?

release.yml drops the vault-action secret read and create-github-app-token
in favour of hashintel/.github/.github/actions/github-app-token, which has
Vault sign the App JWT
the job now declares environment: main, which is what resolves the production
Vault address, and puts the environment claim in the OIDC token so the Vault
role can bind it
authenticates as the hash-release App (four permissions) rather than
hash-worker (nine)

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

do not affect the execution graph

⚠️ Known issues

The action is pinned to an unmerged commit of hashintel/.github#95, marked in
place with # unmerged — re-pin to main. It has to be re-pinned once that PR
merges, and this PR must not merge before then.

🐾 Next steps

Once a release run is green, the App key can be revoked in the App settings.

🛡 What tests cover this?

None automated. The JWT assembly was verified against the GitHub API, and the
imported key was verified byte-for-byte against its PEM.

❓ How to test this?

Merge SRE-924: Sign the Renovate App JWT in Vault .github#95 and re-pin the action to main
Push to main
Confirm the release job obtains a token and changesets runs; a mismatched role,
claim or key fails visibly at the Vault login or the App JWT exchange

vercel · 2026-08-05T16:45:59Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 6, 2026 1:40pm
hashdotdesign-tokens	Ready	Preview	Aug 6, 2026 1:40pm
petrinaut	Ready	Preview	Aug 6, 2026 1:40pm

cursor · 2026-08-05T16:46:04Z

PR Summary

High Risk
Release authentication changes how production GitHub App tokens are minted; a misconfigured Vault role, CF Access, or action pin would block releases on main.

Overview
Release no longer reads a GitHub App private key from the legacy Vault or uses create-github-app-token. The job runs under environment: main and uses hashintel/.github’s github-app-token action so Vault (ci-hash-release, transit key github-app-hash-release) signs the App JWT for a dedicated release App scoped to this repo.

Deploy sourcemaps Vault login now picks prod vs stage explicitly via VAULT_PROD_ADDR / VAULT_STAGE_ADDR and matching Cloudflare Access org vars/secrets (same main vs non-main ref rule as the job environment), instead of relying on environment-resolved generic VAULT_ADDR / CF vars.

Housekeeping drops workflow-wide permissions in favor of minimal per-job grants, bumps the shared housekeeping-dependencies reusable workflow pin, and passes CF_ACCESS_STAGE_CLIENT_SECRET into that workflow for stage Vault access.

^{Reviewed by Cursor Bugbot for commit 9560cc0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Copilot

Pull request overview

Moves release-token minting to a dedicated GitHub App whose key remains in Vault.

Changes:

Uses the shared Vault-backed token action.
Scopes production Vault access through the main environment.
Removes direct private-key retrieval.

codspeed-hq · 2026-08-05T16:54:13Z

Merging this PR will not alter performance

✅ 98 untouched benchmarks

_{Comparing t/sre-924-sign-the-github-app-jwt-with-vault-transit-instead-of (9560cc0) with main (07b572c)¹}

No successful run was found on main (4877809) during the generation of this report, so 07b572c was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

The release job read the App key from the legacy Vault's `dev` role and minted a token with no repository scope, so it could write to every repository the installation covers, using an App that also carries `workflows: write`. It now signs with the hash-release App, whose four permissions are what changesets actually needs, and the token is scoped to this repository. Declaring `environment: main` is what resolves the production Vault, and it puts the environment claim in the OIDC token for the role to bind.

The action no longer defaults it, so the caller says which repository the installation token may reach.

codecov · 2026-08-06T10:59:34Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.57%. Comparing base (ac5ec9c) to head (9560cc0).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9167   +/-   ##
=======================================
  Coverage   59.57%   59.57%           
=======================================
  Files        1413     1413           
  Lines      138053   138053           
  Branches     6510     6510           
=======================================
+ Hits        82240    82244    +4     
+ Misses      54771    54767    -4     
  Partials     1042     1042

Flag	Coverage Δ
apps.hash-ai-worker-ts	`1.99% <ø> (ø)`
apps.hash-api	`12.56% <ø> (ø)`
blockprotocol.type-system	`40.84% <ø> (ø)`
local.claude-hooks	`0.00% <ø> (ø)`
local.harpc-client	`51.49% <ø> (ø)`
local.hash-backend-utils	`3.27% <ø> (ø)`
local.hash-graph-sdk	`10.02% <ø> (ø)`
local.hash-isomorphic-utils	`12.25% <ø> (ø)`
rust.antsi	`2.36% <ø> (ø)`
rust.error-stack	`90.81% <ø> (ø)`
rust.harpc-codec	`84.70% <ø> (ø)`
rust.harpc-net	`96.26% <ø> (+0.06%)`	⬆️
rust.harpc-tower	`67.03% <ø> (ø)`
rust.harpc-types	`0.00% <ø> (ø)`
rust.harpc-wire-protocol	`92.23% <ø> (ø)`
rust.hash-codec	`72.76% <ø> (ø)`
rust.hash-graph-api	`7.36% <ø> (ø)`
rust.hash-graph-authorization	`62.59% <ø> (ø)`
rust.hash-graph-embeddings	`91.88% <ø> (ø)`
rust.hash-graph-postgres-store	`29.66% <ø> (ø)`
rust.hash-graph-store	`42.16% <ø> (ø)`
rust.hash-graph-temporal-versioning	`47.95% <ø> (ø)`
rust.hash-graph-types	`0.00% <ø> (ø)`
rust.hash-graph-validation	`84.71% <ø> (ø)`
rust.hashql-ast	`89.63% <ø> (ø)`
rust.hashql-compiletest	`28.39% <ø> (ø)`
rust.hashql-core	`78.98% <ø> (ø)`
rust.hashql-diagnostics	`72.51% <ø> (ø)`
rust.hashql-eval	`79.82% <ø> (ø)`
rust.hashql-hir	`89.09% <ø> (ø)`
rust.hashql-mir	`87.92% <ø> (ø)`
rust.hashql-syntax-jexpr	`94.04% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Co-authored-by: Tim Diekmann <21277928+TimDiekmann@users.noreply.github.com> Signed-off-by: Tim Diekmann <21277928+TimDiekmann@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/release.yml:21

The PR’s stated precondition says 89ff06b… is still an unmerged branch commit and must be re-pinned after hashintel/.github#95 lands. This SHA is also used by .github/workflows/housekeeping.yml:68, so both references must be updated to a commit on main before this PR merges; otherwise the release and Renovate workflows remain coupled to an unmerged implementation.

        uses: hashintel/.github/.github/actions/github-app-token@89ff06bc761f0c0491d87a766eccce5aae6190ea # main

The environments held the address and Access credentials, so the staging pair lived both there and as the organization-level suffixed values the Renovate path needs. Reading the suffixed names everywhere leaves one place to rotate per tier, and the environments go back to carrying only the claim the Vault roles bind.

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

.github/workflows/release.yml:21

This still pins the unmerged commit explicitly listed under “Blocked by” and “Known issues” in the PR description (the same SHA is also used in housekeeping.yml:68), although the inline annotation says main. Merging in this state would make release depend on code that has not landed on the action's main branch. After hashintel/.github#95 merges, update both pins to the merged main commit before merging this PR.

        uses: hashintel/.github/.github/actions/github-app-token@89ff06bc761f0c0491d87a766eccce5aae6190ea # main

github-actions · 2026-08-06T14:48:29Z

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$27.6 \mathrm{ms} \pm 210 \mathrm{μs}\left({\color{gray}-2.047 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.50 \mathrm{ms} \pm 20.1 \mathrm{μs}\left({\color{gray}-2.396 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$13.6 \mathrm{ms} \pm 81.8 \mathrm{μs}\left({\color{gray}1.35 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$44.5 \mathrm{ms} \pm 421 \mathrm{μs}\left({\color{gray}1.42 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$15.1 \mathrm{ms} \pm 131 \mathrm{μs}\left({\color{gray}-4.012 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$24.8 \mathrm{ms} \pm 196 \mathrm{μs}\left({\color{gray}-1.170 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$29.3 \mathrm{ms} \pm 250 \mathrm{μs}\left({\color{gray}0.892 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.91 \mathrm{ms} \pm 31.2 \mathrm{μs}\left({\color{gray}-1.204 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$15.1 \mathrm{ms} \pm 110 \mathrm{μs}\left({\color{gray}3.87 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$3.93 \mathrm{ms} \pm 31.2 \mathrm{μs}\left({\color{gray}0.589 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.12 \mathrm{ms} \pm 21.7 \mathrm{μs}\left({\color{gray}1.88 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.48 \mathrm{ms} \pm 28.4 \mathrm{μs}\left({\color{gray}1.86 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.36 \mathrm{ms} \pm 36.5 \mathrm{μs}\left({\color{gray}-0.503 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.62 \mathrm{ms} \pm 24.6 \mathrm{μs}\left({\color{gray}-0.303 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.24 \mathrm{ms} \pm 30.9 \mathrm{μs}\left({\color{gray}-1.505 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.58 \mathrm{ms} \pm 37.9 \mathrm{μs}\left({\color{gray}2.11 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.59 \mathrm{ms} \pm 27.0 \mathrm{μs}\left({\color{gray}0.963 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.24 \mathrm{ms} \pm 31.2 \mathrm{μs}\left({\color{gray}-0.212 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.72 \mathrm{ms} \pm 17.1 \mathrm{μs}\left({\color{gray}-0.613 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.60 \mathrm{ms} \pm 15.9 \mathrm{μs}\left({\color{gray}1.24 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.74 \mathrm{ms} \pm 18.7 \mathrm{μs}\left({\color{gray}-0.169 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$3.02 \mathrm{ms} \pm 19.7 \mathrm{μs}\left({\color{gray}0.491 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.78 \mathrm{ms} \pm 15.0 \mathrm{μs}\left({\color{gray}-0.402 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$3.02 \mathrm{ms} \pm 20.9 \mathrm{μs}\left({\color{gray}0.553 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.17 \mathrm{ms} \pm 22.9 \mathrm{μs}\left({\color{gray}2.56 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.83 \mathrm{ms} \pm 15.9 \mathrm{μs}\left({\color{gray}0.029 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$3.02 \mathrm{ms} \pm 14.7 \mathrm{μs}\left({\color{gray}-1.096 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.59 \mathrm{ms} \pm 27.7 \mathrm{μs}\left({\color{gray}1.77 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.07 \mathrm{ms} \pm 18.0 \mathrm{μs}\left({\color{gray}1.27 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.36 \mathrm{ms} \pm 20.7 \mathrm{μs}\left({\color{gray}-0.743 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.52 \mathrm{ms} \pm 26.0 \mathrm{μs}\left({\color{gray}2.36 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.05 \mathrm{ms} \pm 16.5 \mathrm{μs}\left({\color{gray}2.20 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.48 \mathrm{ms} \pm 35.3 \mathrm{μs}\left({\color{gray}2.73 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$44.3 \mathrm{ms} \pm 267 \mathrm{μs}\left({\color{gray}1.85 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$34.7 \mathrm{ms} \pm 166 \mathrm{μs}\left({\color{gray}1.38 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$37.7 \mathrm{ms} \pm 218 \mathrm{μs}\left({\color{gray}0.513 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$33.5 \mathrm{ms} \pm 219 \mathrm{μs}\left({\color{gray}0.742 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$44.5 \mathrm{ms} \pm 271 \mathrm{μs}\left({\color{gray}1.71 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$51.1 \mathrm{ms} \pm 231 \mathrm{μs}\left({\color{gray}-0.802 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$42.9 \mathrm{ms} \pm 269 \mathrm{μs}\left({\color{gray}1.38 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$91.0 \mathrm{ms} \pm 691 \mathrm{μs}\left({\color{gray}-2.094 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$36.1 \mathrm{ms} \pm 323 \mathrm{μs}\left({\color{gray}0.923 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$284 \mathrm{ms} \pm 884 \mathrm{μs}\left({\color{lightgreen}-8.266 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$11.7 \mathrm{ms} \pm 71.8 \mathrm{μs}\left({\color{gray}2.54 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$11.9 \mathrm{ms} \pm 79.9 \mathrm{μs}\left({\color{gray}2.83 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$11.9 \mathrm{ms} \pm 71.4 \mathrm{μs}\left({\color{gray}2.96 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$11.8 \mathrm{ms} \pm 67.0 \mathrm{μs}\left({\color{gray}2.20 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$11.8 \mathrm{ms} \pm 66.5 \mathrm{μs}\left({\color{gray}1.09 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$11.7 \mathrm{ms} \pm 67.0 \mathrm{μs}\left({\color{gray}0.678 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$11.9 \mathrm{ms} \pm 78.1 \mathrm{μs}\left({\color{gray}3.79 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$11.9 \mathrm{ms} \pm 75.7 \mathrm{μs}\left({\color{gray}2.26 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$12.3 \mathrm{ms} \pm 90.9 \mathrm{μs}\left({\color{gray}4.39 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$12.5 \mathrm{ms} \pm 79.7 \mathrm{μs}\left({\color{gray}2.60 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/block/v/1`	$$12.3 \mathrm{ms} \pm 69.3 \mathrm{μs}\left({\color{gray}-0.345 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/book/v/1`	$$12.3 \mathrm{ms} \pm 85.0 \mathrm{μs}\left({\color{gray}-0.855 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/building/v/1`	$$12.2 \mathrm{ms} \pm 86.1 \mathrm{μs}\left({\color{gray}-0.007 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/organization/v/1`	$$12.3 \mathrm{ms} \pm 66.3 \mathrm{μs}\left({\color{gray}-1.161 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/page/v/2`	$$12.2 \mathrm{ms} \pm 79.1 \mathrm{μs}\left({\color{gray}0.440 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/person/v/1`	$$12.6 \mathrm{ms} \pm 87.0 \mathrm{μs}\left({\color{gray}2.08 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/playlist/v/1`	$$12.4 \mathrm{ms} \pm 65.0 \mathrm{μs}\left({\color{gray}3.05 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/song/v/1`	$$12.8 \mathrm{ms} \pm 94.1 \mathrm{μs}\left({\color{red}6.50 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: `https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1`	$$12.4 \mathrm{ms} \pm 72.4 \mathrm{μs}\left({\color{gray}3.37 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: `bf5a9ef5-dc3b-43cf-a291-6210c0321eba`	$$9.19 \mathrm{ms} \pm 55.8 \mathrm{μs}\left({\color{gray}1.30 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$65.7 \mathrm{ms} \pm 527 \mathrm{μs}\left({\color{red}9.25 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$119 \mathrm{ms} \pm 646 \mathrm{μs}\left({\color{gray}4.24 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$73.1 \mathrm{ms} \pm 478 \mathrm{μs}\left({\color{red}7.92 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$84.2 \mathrm{ms} \pm 524 \mathrm{μs}\left({\color{red}8.96 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$92.9 \mathrm{ms} \pm 445 \mathrm{μs}\left({\color{red}6.67 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$98.4 \mathrm{ms} \pm 561 \mathrm{μs}\left({\color{gray}4.73 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$46.9 \mathrm{ms} \pm 263 \mathrm{μs}\left({\color{red}5.11 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$76.4 \mathrm{ms} \pm 487 \mathrm{μs}\left({\color{gray}2.19 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$53.1 \mathrm{ms} \pm 374 \mathrm{μs}\left({\color{red}5.22 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$63.2 \mathrm{ms} \pm 476 \mathrm{μs}\left({\color{gray}3.37 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$65.7 \mathrm{ms} \pm 382 \mathrm{μs}\left({\color{gray}2.48 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$64.9 \mathrm{ms} \pm 509 \mathrm{μs}\left({\color{gray}0.670 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$121 \mathrm{ms} \pm 911 \mathrm{μs}\left({\color{gray}-2.831 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$132 \mathrm{ms} \pm 633 \mathrm{μs}\left({\color{gray}-2.860 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$25.3 \mathrm{ms} \pm 228 \mathrm{μs}\left({\color{gray}2.57 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$555 \mathrm{ms} \pm 1.22 \mathrm{ms}\left({\color{red}8.81 \mathrm{\%}}\right) $$	Flame Graph

Copilot AI balanced review requested due to automatic review settings August 5, 2026 16:45

graphite-app Bot assigned TimDiekmann Aug 5, 2026

github-actions Bot added the area/infra Relates to version control, CI, CD or IaC (area) label Aug 5, 2026

TimDiekmann temporarily deployed to pull-request August 5, 2026 16:46 — with GitHub Actions Inactive

Copilot started reviewing on behalf of TimDiekmann August 5, 2026 16:46 View session

Copilot AI reviewed Aug 5, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

Copilot AI review requested due to automatic review settings August 5, 2026 16:53

Copilot started reviewing on behalf of TimDiekmann August 5, 2026 16:54 View session

TimDiekmann temporarily deployed to pull-request August 5, 2026 16:55 — with GitHub Actions Inactive

Copilot AI reviewed Aug 5, 2026

View reviewed changes

vercel Bot deployed to Preview – hashdotdesign-tokens August 5, 2026 16:56 View deployment

vercel Bot deployed to Preview – petrinaut August 5, 2026 16:58 View deployment

vercel Bot deployed to Preview – hash August 5, 2026 17:13 View deployment

Copilot AI review requested due to automatic review settings August 5, 2026 18:49

Copilot started reviewing on behalf of TimDiekmann August 5, 2026 18:50 View session

TimDiekmann temporarily deployed to pull-request August 5, 2026 18:50 — with GitHub Actions Inactive

Copilot AI reviewed Aug 5, 2026

View reviewed changes

vercel Bot deployed to Preview – hashdotdesign-tokens August 5, 2026 18:52 View deployment

vercel Bot deployed to Preview – petrinaut August 5, 2026 18:54 View deployment

vercel Bot deployed to Preview – hash August 5, 2026 19:07 View deployment

Base automatically changed from t/sre-915-narrow-vault-dev-role-housekeeping-workflow to main August 6, 2026 08:24

TimDiekmann added 3 commits August 6, 2026 10:52

SRE-924: Name the repository the token is scoped to

e0637e8

The action no longer defaults it, so the caller says which repository the installation token may reach.

SRE-924: Say the pin returns to a SHA, not to @main

7dc0581

vercel Bot deployed to Preview – petrinaut August 6, 2026 10:58 View deployment

vercel Bot deployed to Preview – hash August 6, 2026 11:07 View deployment

TimDiekmann requested a review from a team August 6, 2026 11:16

TimDiekmann enabled auto-merge August 6, 2026 11:16

TimDiekmann commented Aug 6, 2026

View reviewed changes

Comment thread .github/workflows/release.yml Outdated

Apply suggestions from code review

ec9ea4a

Co-authored-by: Tim Diekmann <21277928+TimDiekmann@users.noreply.github.com> Signed-off-by: Tim Diekmann <21277928+TimDiekmann@users.noreply.github.com>

Copilot AI review requested due to automatic review settings August 6, 2026 12:33

Copilot started reviewing on behalf of TimDiekmann August 6, 2026 12:34 View session

TimDiekmann temporarily deployed to pull-request August 6, 2026 12:34 — with GitHub Actions Inactive

vercel Bot deployed to Preview – hashdotdesign-tokens August 6, 2026 12:35 View deployment

Copilot AI reviewed Aug 6, 2026

View reviewed changes

vercel Bot deployed to Preview – petrinaut August 6, 2026 12:38 View deployment

vercel Bot deployed to Preview – hash August 6, 2026 12:51 View deployment

Copilot AI review requested due to automatic review settings August 6, 2026 13:26

Copilot started reviewing on behalf of TimDiekmann August 6, 2026 13:27 View session

TimDiekmann temporarily deployed to pull-request August 6, 2026 13:27 — with GitHub Actions Inactive

vercel Bot deployed to Preview – hashdotdesign-tokens August 6, 2026 13:29 View deployment

Copilot AI reviewed Aug 6, 2026

View reviewed changes

vercel Bot deployed to Preview – petrinaut August 6, 2026 13:31 View deployment

vercel Bot deployed to Preview – hash August 6, 2026 13:40 View deployment

CiaranMn approved these changes Aug 6, 2026

View reviewed changes

TimDiekmann added this pull request to the merge queue Aug 6, 2026

Merged via the queue into main with commit c072f0d Aug 6, 2026
192 checks passed

TimDiekmann deleted the t/sre-924-sign-the-github-app-jwt-with-vault-transit-instead-of branch August 6, 2026 14:44

Uh oh!

Conversation

TimDiekmann commented Aug 5, 2026

🌟 What is the purpose of this PR?

🔗 Related links

🚫 Blocked by

🔍 What does this change?

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

📜 Does this require a change to the docs?

🕸️ Does this require a change to the Turbo Graph?

⚠️ Known issues

🐾 Next steps

🛡 What tests cover this?

❓ How to test this?

Uh oh!

vercel Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

codspeed-hq Bot commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

codecov Bot commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

github-actions Bot commented Aug 6, 2026

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

policy_resolution_medium

policy_resolution_none

policy_resolution_small

read_scaling_complete

read_scaling_linkless

representative_read_entity

representative_read_entity_type

representative_read_multiple_entities

scenarios

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

vercel Bot commented Aug 5, 2026 •

edited

Loading

cursor Bot commented Aug 5, 2026 •

edited

Loading

codspeed-hq Bot commented Aug 5, 2026 •

edited

Loading

codecov Bot commented Aug 6, 2026 •

edited

Loading