Repository navigation
ci: drop the design deploy key now that the repositories are public - #96
Merged
Merged
Conversation
Once hyperstructure/design is public, npm downloads @hyperstructure/design from GitHub without signing in: for a public GitHub dependency it fetches the commit's tarball over HTTPS, even though the lockfile records a git+ssh URL. So CI no longer needs DESIGN_DEPLOY_KEY, and the repo-access action is left with one job: pushing fctl.sh's docs pin to fctl-site with SITE_DEPLOY_KEY. AGENTS.md, the development docs and the roadmap stop saying the repositories are private. Merge only after design is public: until then npm ci cannot reach the package and CI fails.
This was referenced Oct 18, 2026
Merged
kalaspuff
pushed a commit
that referenced
this pull request
Oct 18, 2026
Release's `publish` job (which uses `CLOUDFLARE_API_TOKEN`) and CI's `site-docs` job (which uses `SITE_DEPLOY_KEY`) now run in the `production` environment, as the `deploy` job already does. ## Why Before the repositories go public: - **Today, any branch can read the production secrets.** `production` has no branch rule, and the secrets are repository secrets. The run logs show Release's `publish` job receives `CLOUDFLARE_API_TOKEN` without an environment. Agent sessions' tokens have `contents: write` and `workflows: write`, so a workflow on any branch an agent pushes can read the Cloudflare token (which can redeploy app.fctl.sh) and `SITE_DEPLOY_KEY` (which can push to fctl-site's `main`, and so change `fctl.sh/install`). - **This PR is the first half of the fix.** Once it's merged, an admin moves those secrets into the `production` environment and limits the environment to `main`. Workflows on other branches then can't read them. - **Order matters.** Jobs in an environment can still read repository secrets, so merging this first breaks nothing. Move the secrets afterwards. `docs/development.md` says where these secrets live. ## How I verified it - actionlint 1.7.12 passes on `.github/workflows/`. - The `deploy` job has run in `production` all along, so the `environment:` key works with these workflows' permissions. - `publish` runs from `main` (a `workflow_dispatch` on `main`), so a `main`-only policy allows it, including `tag` rebuilds. - Merging this runs `site-docs` (`docs/` changed), which checks the job inside the environment. Refs #22. Session: https://app.fctl.sh/s/ses_01M58A7MAFDWKZDCA239GR6H6G ## Related pull requests Merge before the flip: - #95: production secrets move into the production environment - hyperstructure/fctl-site#18: a security policy (any time) Merge after the flip (drafts until then): - #96: fctl stops using DESIGN_DEPLOY_KEY - hyperstructure/fctl-site#17: fctl-site stops using DESIGN_DEPLOY_KEY and FCTL_DEPLOY_KEY - hyperstructure/design#12: README no longer says the repository is private - hyperstructure/sandbox#4: AGENTS.md no longer says fctl is private Co-authored-by: fctl-sh[bot] <fctl-sh[bot]@users.noreply.github.com>
kalaspuff
pushed a commit
to hyperstructure/fctl-site
that referenced
this pull request
Oct 18, 2026
Adds a `SECURITY.md`, as hyperstructure/fctl and hyperstructure/sandbox have. Reports go through GitHub's private vulnerability reporting, which an admin turns on once the repository is public. fctl.sh serves `/install`, which people pipe to `sh`, so reports about the site shouldn't land in public issues. This can merge before or after the repositories go public. Part of making fctl, fctl-site and design public: hyperstructure/fctl#95, hyperstructure/fctl#96, #17, hyperstructure/design#12, hyperstructure/sandbox#4. Session: https://app.fctl.sh/s/ses_01M58A7MAFDWKZDCA239GR6H6G Co-authored-by: fctl-sh[bot] <fctl-sh[bot]@users.noreply.github.com>
kalaspuff
marked this pull request as ready for review
October 18, 2026 21:12
kalaspuff
pushed a commit
to hyperstructure/fctl-site
that referenced
this pull request
Oct 18, 2026
**Merge only after hyperstructure/fctl and hyperstructure/design are both public.** Until then the build can't reach them without the deploy keys, so CI on this pull request fails. Re-run it after the flip. ## What changes - The `build` job no longer sets up `DESIGN_DEPLOY_KEY` and `FCTL_DEPLOY_KEY`, or the git URL rewrites that sent GitHub fetches over SSH. - `AGENTS.md` says where CI's secrets live now (the `production` environment) and that building needs no keys. ## Why it works without the keys - **The design package.** npm downloads it as a tarball over HTTPS from codeload.github.com. The lockfile's `git+ssh://` URL doesn't force SSH. I checked this with npm 10.9 and SSH disabled, using a public GitHub dependency. - **fctl's docs.** `scripts/docs.mjs` fetches the commit in `fctl-docs.ref` by SHA over HTTPS. GitHub serves that to anyone for a public repository. I checked this anonymously against the public hyperstructure/sandbox. - **Order matters.** Merge this before deleting the keys. With an empty key, the old step still rewrites `https://github.com/hyperstructure/fctl.git` to SSH, so the docs build would fail. ## After merging An admin deletes both secrets here, and the read deploy keys on hyperstructure/design and hyperstructure/fctl. ## Related - hyperstructure/fctl#95: production secrets move into the environment (before the flip) - hyperstructure/fctl#96: fctl's own deploy-key cleanup (after the flip) - hyperstructure/design#12 and hyperstructure/sandbox#4: wording (after the flip) ## Verified actionlint 1.7.12 passes. Session: https://app.fctl.sh/s/ses_01M58A7MAFDWKZDCA239GR6H6G Co-authored-by: fctl-sh[bot] <fctl-sh[bot]@users.noreply.github.com>
kalaspuff
pushed a commit
to hyperstructure/design
that referenced
this pull request
Oct 18, 2026
**Merge after this repository is public.** - **README.** The README said to depend on a tag *because* the repository was private. Once it's public, npm downloads the tagged package from GitHub without signing in, so the README says that instead. - **SECURITY.md.** A security policy, as hyperstructure/fctl and hyperstructure/sandbox have. Reports go through GitHub's private vulnerability reporting, which an admin turns on once the repository is public. Part of making fctl, fctl-site and design public: hyperstructure/fctl#95, hyperstructure/fctl#96 and hyperstructure/fctl-site#17 drop the deploy keys that read this repository. Session: https://app.fctl.sh/s/ses_01M58A7MAFDWKZDCA239GR6H6G --------- Co-authored-by: fctl-sh[bot] <fctl-sh[bot]@users.noreply.github.com>
kalaspuff
pushed a commit
to hyperstructure/sandbox
that referenced
this pull request
Oct 18, 2026
**Merge after hyperstructure/fctl is public.** `AGENTS.md` told agents to link to https://fctl.sh instead of fctl's files because hyperstructure/fctl was private. Once it's public, they can link to its code as well. Part of making fctl, fctl-site and design public: hyperstructure/fctl#95, hyperstructure/fctl#96, hyperstructure/fctl-site#17 and hyperstructure/design#12. Session: https://app.fctl.sh/s/ses_01M58A7MAFDWKZDCA239GR6H6G Co-authored-by: fctl-sh[bot] <fctl-sh[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge only after hyperstructure/design is public. Until then
npm cican't reach the design package without the key, so CI on this pull request fails. Re-run it after the flip.What changes
check,devanddeployjobs and Release'spublishjob stop setting upDESIGN_DEPLOY_KEY.repo-accessaction is now used only bysite-docs, which pushes fctl.sh's docs pin to fctl-site withSITE_DEPLOY_KEY. Its description no longer talks about private repositories.AGENTS.md,docs/development.mdandROADMAP.mdno longer say the repositories are private. Moving@hyperstructure/designto npm stays on the roadmap as its own item, but it isn't needed to drop the keys.Why no lockfile change
The lockfile records
git+ssh://git@github.com/hyperstructure/design.git#<sha>. For a GitHub dependency, npm first downloads the commit's tarball over HTTPS (codeload.github.com) and falls back to git only when that fails. For a public repository, that download needs no sign-in.I checked this with npm 10.9 and a public GitHub dependency (
github:sindresorhus/is-plain-obj#v4.1.0), with SSH disabled (GIT_SSH_COMMAND=/bin/false) and no git config:npm installwrote agit+ssh://URL into the lockfile.npm cifrom that lockfile succeeded.cargo xtask devinstalls withnpm citoo.After merging
An admin deletes the
DESIGN_DEPLOY_KEYsecret here and the deploy key on hyperstructure/design. fctl-site's matching change is linked below.Verified
npm ci.Refs #22. Session: https://app.fctl.sh/s/ses_01M58A7MAFDWKZDCA239GR6H6G
Related pull requests
Merge before the flip:
Merge after the flip (drafts until then):