Restore CI, Disable CD - #1094
Draft
ehildenb wants to merge 12 commits into
Draft
Conversation
Upgrade all actions/checkout uses from v4 to v6 (Node 24 runtime, fixed tag/fetch-tags handling, credentials persisted to a separate file). No behavioral change for our usage; prerequisite for dropping the explicit JENKINS_GITHUB_PAT from read-only checkout steps. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…PAT from checkout These checkout steps only read the repo and its (public) stable-mir-json submodule, so the automatic GITHUB_TOKEN suffices. Removing the explicit token: line falls back to that default token, eliminating the PAT from these read-only jobs. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
v7 is the current major. Its only breaking change tightens the default for pull_request_target / workflow_run (no longer checks out fork-PR head code unless allow-unsafe-pr-checkout is set) — a security hardening. None of our workflows use those triggers, so behavior is unchanged, and the safer default aligns with the CI-secret-hardening goal. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…tral-sh/setup-uv v6 → v9 Update setup-uv to the current major. The uv binary version installed is still pinned via deps/uv_release, so only the action wrapper changes. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…t v4 → v7 Update to the current major. v7 requires a self-hosted runner version of at least 2.327.1; this workflow runs on the self-hosted normal runner. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ctions to latest setup-buildx-action v3.10.0 → v4.2.0, build-push-action v6 → v7, login-action v3.4.0 → v4.5.1. Current majors; no change to build/push args. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…ions to latest install-nix-action v31.5.1 → v31.11.0 (same major, bugfixes), cachix-action v16 → v17. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…elease/CD pipeline Delete the release-and-publish workflows from the public repo. These carried all the privileged deploy secrets (DOCKERHUB_PASSWORD, CACHIX_PUBLIC_TOKEN, CACHIX_PRIVATE_KFB_TOKEN, JENKINS_GITHUB_PAT) and pushed images / release tags / cross-repo dispatches. CD will be reconstituted in a locked-down private repository so that no secret is reachable from CI on the public repo. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…omation Delete the dependency-update workflow: it pushed commits back to the repo using JENKINS_GITHUB_PAT and is not a testing workflow. Dependency automation moves to the locked-down automation repo, keeping the public CI secret-free. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…in.sh: remove cachix-pin verification Delete the release-artifact Cachix pin verification workflow (it carried CACHIX_PRIVATE_KFB_TOKEN) and its now-orphaned helper script, whose only other referencer was the removed release pipeline. This is release tooling, not testing, and belongs with CD in the locked-down repo. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
setup-uv does not publish a floating major tag from v7 onward (v6 had one, which is why @v6 resolved), so @v9 fails to resolve on the runner. Pin to the full v9.0.0 tag, which exists. Verified the remaining action refs in the kept workflows all resolve. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…cachix-action The nix smoke-test job used cachix/cachix-action, which authenticated with a Cachix token configured on the self-hosted runner (surfacing as the revoked CACHIX_WEB_PRIVATE_TOKEN), keeping a secret in scope for CI. k-framework is a public cache, so pull it as a plain anonymous substituter via extra_nix_config (URL + public signing key) and remove the cachix-action step entirely. No token is used, and no push is attempted. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR removes secrets entirely from the github repository, so that we can safely re-enable CI. In particular:
upload-artifactusage is removed.