feat(orb): hardwire fleet telemetry on (no opt-out); anonymize with the App secret - #1257
Merged
Conversation
![superagent-security[bot]](https://avatars.githubusercontent.com/in/3287076?s=60&v=4){kind=small}
superagent-security
Bot
added
the
pr:flagged
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1257 +/- ##
=======================================
Coverage 95.04% 95.04%
=======================================
Files 177 177
Lines 19927 19933 +6
Branches 7178 7176 -2
=======================================
+ Hits 18939 18945 +6
Misses 395 395
Partials 593 593
🚀 New features to boost your workflow:
|
superagent-security
Bot
removed
the
pr:flagged
10 tasks
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
gittensory-ui | c9e8b41 | Commit Preview URL Branch Preview URL |
Jun 24 2026, 09:58 PM |
JSONbored
added
the
orb
superagent-security
Bot
added
the
pr:flagged
…App secret Remove the ORB_ENABLED opt-in — Orb fleet-calibration export is now ALWAYS ON (the contract of self-hosting gittensory). It self-gates on a configured GitHub App webhook secret (no App → no review data to export anyway) and uses that secret (GITHUB_WEBHOOK_SECRET) as the per-instance anonymization key, so there is no separate ORB_WEBHOOK_SECRET to set. ORB_AIR_GAP stays for air-gapped/offline deployments only. .env.example now carries a prominent TELEMETRY NOTICE: running the self-host image contributes anonymized, on-by-default calibration data. repo/PR identifiers are HMAC'd with the instance's own secret (the collector can never de-anonymize them) and no code / PII / repo names / commit SHAs are sent.
Address two review findings on the always-on telemetry: P1 — stop reusing GITHUB_WEBHOOK_SECRET as the anonymization key. A low-entropy webhook secret made the 24-char HMACs brute-forceable, and coupling the two boundaries meant rotating the webhook secret would silently break repo-hash dedup continuity on the collector. Derive a DEDICATED, domain-separated key from GITHUB_APP_PRIVATE_KEY (high-entropy RSA material) via HMAC(appKey, "gittensory-orb-anon-v1"), and gate export on the App private key. No new operator config; the webhook secret stays single-purpose. P2 — the always-on hourly export cron no longer swallows errors silently; it logs a structured selfhost_orb_export_error (message) so operators can detect reliability issues.
JSONbored
force-pushed
the
feat/orb-hardwire
branch
from
June 24, 2026 22:04
c9e8b41 to
dc1afd1
Compare
This was referenced Jun 24, 2026
…ivate key Stop using GITHUB_APP_PRIVATE_KEY as HMAC key material for telemetry anonymization (key separation — the App's RSA private key is for JWT signing only). Generate a 256-bit random secret once, persist it in system_flags (getOrCreateAnonSecret), and reuse it on every export: stable so the collector can still dedup, per-instance, single-purpose. The App private key now only GATES export (configured ⇒ there is review data to send).
This was referenced Jun 24, 2026
Contributor
|
Superagent didn't find any vulnerabilities or security issues in this PR. |
superagent-security
Bot
removed
the
pr:flagged
This was referenced Jun 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Makes Orb fleet-calibration export always-on per the directive — no
ORB_ENABLEDopt-out. Self-hosting gittensory now contributes anonymized calibration telemetry by default, the way the fleet collector (#1255) is meant to work.What changed
ORB_ENABLEDand theorbEnabled()gate. The hourly export cron always runs;exportOrbBatchself-gates on a configured GitHub App webhook secret — no App configured → no review data to export → no-op, so first-run is clean.GITHUB_WEBHOOK_SECRET(the App's own secret, present once the App is set up) instead of a separateORB_WEBHOOK_SECRET. One less thing to configure; still a per-instance key the collector never holds.ORB_AIR_GAPkept strictly as an air-gapped/offline escape (instances with no internet), not advertised as a telemetry opt-out.Transparency
.env.examplenow leads with a TELEMETRY NOTICE: running the self-host image contributes anonymized, on-by-default calibration data, and spells out exactly what is sent (verdict, outcome, reversal flag, bucketed reason, cycle time) and what is never sent (repo/owner/PR names, commit SHAs, code, diffs, comments, logins). repo/PR identifiers are HMAC'd with the instance's own secret → the collector can never de-anonymize them.This is a deliberate product decision (use the tool ⇒ contribute anonymized fleet signal); the disclosure is prominent so self-hosters aren't surprised by the outbound calls.
Validation
npm run test:cigreen;npm audit0 vulnerabilitiesorb-collector.ts(incl. the new "no App secret → no-op" gate)Advances #1255.