Repository navigation
docs: link to fctl's code now that its repository is public - #4
Merged
Merged
Conversation
AGENTS.md told agents to link to https://fctl.sh rather than to hyperstructure/fctl's files because that repository was private. Now that it is public, they can link to its code too. Merge after hyperstructure/fctl is public.
This was referenced Oct 18, 2026
Merged
kalaspuff
pushed a commit
to hyperstructure/fctl
that referenced
this pull request
Oct 18, 2026
Release's `publish` job (which uses `CLOUDFLARE_API_TOKEN`) and CI's `site-docs` job (which uses `SITE_DEPLOY_KEY`) now run in the `production` environment, as the `deploy` job already does. ## Why Before the repositories go public: - **Today, any branch can read the production secrets.** `production` has no branch rule, and the secrets are repository secrets. The run logs show Release's `publish` job receives `CLOUDFLARE_API_TOKEN` without an environment. Agent sessions' tokens have `contents: write` and `workflows: write`, so a workflow on any branch an agent pushes can read the Cloudflare token (which can redeploy app.fctl.sh) and `SITE_DEPLOY_KEY` (which can push to fctl-site's `main`, and so change `fctl.sh/install`). - **This PR is the first half of the fix.** Once it's merged, an admin moves those secrets into the `production` environment and limits the environment to `main`. Workflows on other branches then can't read them. - **Order matters.** Jobs in an environment can still read repository secrets, so merging this first breaks nothing. Move the secrets afterwards. `docs/development.md` says where these secrets live. ## How I verified it - actionlint 1.7.12 passes on `.github/workflows/`. - The `deploy` job has run in `production` all along, so the `environment:` key works with these workflows' permissions. - `publish` runs from `main` (a `workflow_dispatch` on `main`), so a `main`-only policy allows it, including `tag` rebuilds. - Merging this runs `site-docs` (`docs/` changed), which checks the job inside the environment. Refs #22. Session: https://app.fctl.sh/s/ses_01M58A7MAFDWKZDCA239GR6H6G ## Related pull requests Merge before the flip: - #95: production secrets move into the production environment - hyperstructure/fctl-site#18: a security policy (any time) Merge after the flip (drafts until then): - #96: fctl stops using DESIGN_DEPLOY_KEY - hyperstructure/fctl-site#17: fctl-site stops using DESIGN_DEPLOY_KEY and FCTL_DEPLOY_KEY - hyperstructure/design#12: README no longer says the repository is private - hyperstructure/sandbox#4: AGENTS.md no longer says fctl is private Co-authored-by: fctl-sh[bot] <fctl-sh[bot]@users.noreply.github.com>
kalaspuff
pushed a commit
to hyperstructure/fctl-site
that referenced
this pull request
Oct 18, 2026
Adds a `SECURITY.md`, as hyperstructure/fctl and hyperstructure/sandbox have. Reports go through GitHub's private vulnerability reporting, which an admin turns on once the repository is public. fctl.sh serves `/install`, which people pipe to `sh`, so reports about the site shouldn't land in public issues. This can merge before or after the repositories go public. Part of making fctl, fctl-site and design public: hyperstructure/fctl#95, hyperstructure/fctl#96, #17, hyperstructure/design#12, hyperstructure/sandbox#4. Session: https://app.fctl.sh/s/ses_01M58A7MAFDWKZDCA239GR6H6G Co-authored-by: fctl-sh[bot] <fctl-sh[bot]@users.noreply.github.com>
Contributor
Author
|
This checks that fctl-sh[bot] can still comment on hyperstructure's public repositories while the organization's interaction limit (collaborators only, six months) is on, before fctl, design and fctl-site become public. |
kalaspuff
pushed a commit
to hyperstructure/fctl-site
that referenced
this pull request
Oct 18, 2026
**Merge only after hyperstructure/fctl and hyperstructure/design are both public.** Until then the build can't reach them without the deploy keys, so CI on this pull request fails. Re-run it after the flip. ## What changes - The `build` job no longer sets up `DESIGN_DEPLOY_KEY` and `FCTL_DEPLOY_KEY`, or the git URL rewrites that sent GitHub fetches over SSH. - `AGENTS.md` says where CI's secrets live now (the `production` environment) and that building needs no keys. ## Why it works without the keys - **The design package.** npm downloads it as a tarball over HTTPS from codeload.github.com. The lockfile's `git+ssh://` URL doesn't force SSH. I checked this with npm 10.9 and SSH disabled, using a public GitHub dependency. - **fctl's docs.** `scripts/docs.mjs` fetches the commit in `fctl-docs.ref` by SHA over HTTPS. GitHub serves that to anyone for a public repository. I checked this anonymously against the public hyperstructure/sandbox. - **Order matters.** Merge this before deleting the keys. With an empty key, the old step still rewrites `https://github.com/hyperstructure/fctl.git` to SSH, so the docs build would fail. ## After merging An admin deletes both secrets here, and the read deploy keys on hyperstructure/design and hyperstructure/fctl. ## Related - hyperstructure/fctl#95: production secrets move into the environment (before the flip) - hyperstructure/fctl#96: fctl's own deploy-key cleanup (after the flip) - hyperstructure/design#12 and hyperstructure/sandbox#4: wording (after the flip) ## Verified actionlint 1.7.12 passes. Session: https://app.fctl.sh/s/ses_01M58A7MAFDWKZDCA239GR6H6G Co-authored-by: fctl-sh[bot] <fctl-sh[bot]@users.noreply.github.com>
kalaspuff
marked this pull request as ready for review
October 18, 2026 21:13
kalaspuff
pushed a commit
to hyperstructure/fctl
that referenced
this pull request
Oct 18, 2026
) **Merge only after hyperstructure/design is public.** Until then `npm ci` can't reach the design package without the key, so CI on this pull request fails. Re-run it after the flip. ## What changes - CI's `check`, `dev` and `deploy` jobs and Release's `publish` job stop setting up `DESIGN_DEPLOY_KEY`. - The `repo-access` action is now used only by `site-docs`, which pushes fctl.sh's docs pin to fctl-site with `SITE_DEPLOY_KEY`. Its description no longer talks about private repositories. - `AGENTS.md`, `docs/development.md` and `ROADMAP.md` no longer say the repositories are private. Moving `@hyperstructure/design` to npm stays on the roadmap as its own item, but it isn't needed to drop the keys. ## Why no lockfile change The lockfile records `git+ssh://git@github.com/hyperstructure/design.git#<sha>`. For a GitHub dependency, npm first downloads the commit's tarball over HTTPS (codeload.github.com) and falls back to git only when that fails. For a public repository, that download needs no sign-in. I checked this with npm 10.9 and a public GitHub dependency (`github:sindresorhus/is-plain-obj#v4.1.0`), with SSH disabled (`GIT_SSH_COMMAND=/bin/false`) and no git config: - `npm install` wrote a `git+ssh://` URL into the lockfile. - `npm ci` from that lockfile succeeded. `cargo xtask dev` installs with `npm ci` too. ## After merging An admin deletes the `DESIGN_DEPLOY_KEY` secret here and the deploy key on hyperstructure/design. fctl-site's matching change is linked below. ## Verified - actionlint 1.7.12 passes. - Before the flip, CI is expected to fail at `npm ci`. Refs #22. Session: https://app.fctl.sh/s/ses_01M58A7MAFDWKZDCA239GR6H6G ## Related pull requests Merge before the flip: - #95: production secrets move into the production environment - hyperstructure/fctl-site#18: a security policy (any time) Merge after the flip (drafts until then): - #96: fctl stops using DESIGN_DEPLOY_KEY - hyperstructure/fctl-site#17: fctl-site stops using DESIGN_DEPLOY_KEY and FCTL_DEPLOY_KEY - hyperstructure/design#12: README no longer says the repository is private - hyperstructure/sandbox#4: AGENTS.md no longer says fctl is private Co-authored-by: fctl-sh[bot] <fctl-sh[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge after hyperstructure/fctl is public.
AGENTS.mdtold agents to link to https://fctl.sh instead of fctl's files because hyperstructure/fctl was private. Once it's public, they can link to its code as well.Part of making fctl, fctl-site and design public: hyperstructure/fctl#95, hyperstructure/fctl#96, hyperstructure/fctl-site#17 and hyperstructure/design#12.
Session: https://app.fctl.sh/s/ses_01M58A7MAFDWKZDCA239GR6H6G