Repository navigation
Chart Drift: mint a GitHub App installation token instead of a stored PAT (#1709) - #2309
Merged
Merged
Conversation
… PAT (#1709) Chart Drift has failed every run since it was added — nine for nine. The preflight named `secrets.MEMEX_DEPLOY_REPO_TOKEN` as unprovisioned; it was in fact provisioned on 2026-08-17 and has returned HTTP 401 "Bad credentials" ever since. It authenticates as nothing. So drift detection for memex, memex-cloud and atioz has never run at all. The workflow header explained why the fix had to be manual: "A PAT cannot be minted through the API or CLI." That is true of a PAT, but the conclusion does not follow — a GitHub App INSTALLATION token is mintable, and the Systemorph org already has the `meshweaver-cloud` App (id 4220566) installed with access to all 32 repositories, Systemorph/Memex among them. So the credential stops being a stored secret that rots: - preflight, discover and drift each mint a token with actions/create-github-app-token@v2, scoped `repositories: Memex` and `permission-contents: read` — narrower than the read-only PAT it replaces. - Rotation has ONE home: Key Vault `Systemorph/github-app-privatekey`. - secrets.MESHWEAVER_APP_ID / MESHWEAVER_APP_PRIVATE_KEY are provisioned. The other two prerequisites in the header turn out to be satisfied already, so this was the only one left: 1. The overlays are committed — deployments/aks/{memex,memex-cloud,atioz}/ values.<release>.public.yaml all exist in Systemorph/Memex, with the optional portal-patch.json beside them. 3. The CI identity has AKS access — `github-actions-deploy` holds both "Azure Kubernetes Service Cluster Admin Role" and "... Contributor Role" on memexaks-cluster, and Contributor covers Microsoft.ContainerService/managedClusters/* — i.e. runCommand/action. The validity probe is kept exactly as it was, because its lesson is the durable one: PRESENT is not VALID, and this gate learned it the hard way. It still fails RED with no `if:` and no continue-on-error; only the diagnostics change, since 401/403/404 mean different things for an installation token than for a PAT and each takes a different fix. Category: none — CI credential plumbing, no user-visible effect.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes the “Chart Drift” workflow’s authentication model by replacing a stored, long-lived deploy-repo PAT with a per-run GitHub App installation token, so the workflow can reliably read the private Systemorph/Memex overlays needed for drift detection.
Changes:
- Replaces
MEMEX_DEPLOY_REPO_TOKEN(PAT) withMESHWEAVER_APP_ID+MESHWEAVER_APP_PRIVATE_KEYand mints an installation token viaactions/create-github-app-token@v2. - Updates preflight to validate the new secret inputs and probes deploy-repo readability using the minted token.
- Updates deploy-repo checkouts in
discoveranddriftjobs to use the minted token.
Suppressed comments (2)
.github/workflows/chart-drift.yml:236
actions/create-github-app-token@v2does not accept apermission-contentsinput key; it uses apermissionsobject/map (or defaults to the App installation’s permissions). With the current key, the permission restriction may be ignored or the action may fail input validation.
app-id: ${{ secrets.MESHWEAVER_APP_ID }}
private-key: ${{ secrets.MESHWEAVER_APP_PRIVATE_KEY }}
owner: Systemorph
repositories: Memex
permission-contents: read
- name: Check out the deployment repo
.github/workflows/chart-drift.yml:318
actions/create-github-app-token@v2does not accept apermission-contentsinput key; it uses apermissionsobject/map (or defaults to the App installation’s permissions). With the current key, the permission restriction may be ignored or the action may fail input validation.
app-id: ${{ secrets.MESHWEAVER_APP_ID }}
private-key: ${{ secrets.MESHWEAVER_APP_PRIVATE_KEY }}
owner: Systemorph
repositories: Memex
permission-contents: read
- name: Check out the per-env overlays
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1709.
Chart Drifthas failed every run since it was added — nine for nine. The preflight namedsecrets.MEMEX_DEPLOY_REPO_TOKENas unprovisioned; it was in fact provisioned on 2026-08-17 (created_at == updated_at) and has returned HTTP 401 Bad credentials on every run since. It authenticates as nothing. Drift detection formemex,memex-cloudandclient-ihas never run once.The header's premise was half right
True of a PAT. But the conclusion doesn't follow: a GitHub App installation token is mintable, and the org already has the
meshweaver-cloudApp (id 4220566) installed with access to all 32 repos —Systemorph/Memexamong them. Verified by minting one and reading the repo: HTTP 200.So the credential stops being a stored secret that rots:
Contents: Readon Memexrepositories: Memex+permission-contents: read— narrowerSystemorph/github-app-privatekeysecrets.MESHWEAVER_APP_ID/MESHWEAVER_APP_PRIVATE_KEYare provisioned.The other two prerequisites were already done
The issue listed three things. Only the token was outstanding:
deployments/aks/{memex,memex-cloud,client-i}/values.<release>.public.yamlall exist inSystemorph/Memex, with the optionalportal-patch.jsonbeside them.github-actions-deployholds Azure Kubernetes Service Cluster Admin Role and Contributor Role onmemexaks-cluster; Contributor coversMicrosoft.ContainerService/managedClusters/*, i.e.runCommand/action.What is deliberately unchanged
The validity probe stays, because its lesson is the durable one — PRESENT is not VALID, learned here the hard way when an empty-string check went green over a dead token. It still fails RED, no
if:, nocontinue-on-error. Only the diagnostics change: 401/403/404 mean different things for an installation token than for a PAT, and each takes a different fix.Expect the first completing run to be red
Legitimately, and that is the point — the header documents 121 divergences found in a local run against
memexon 2026-08-17, includingAuthentication__Microsoft__ClientIdstill beingCHANGE_ME_...in the chart. That backlog is the finding, not a defect in the gate.What's New: skipped — CI credential plumbing, no user-visible effect.