From b18fc59fe47cfcf687db01da9d198fe377d3b798 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sat, 18 Jul 2026 10:35:47 -0700 Subject: [PATCH 1/2] Correct WORKFLOW.md audit flow and NUGET_USERNAME secret store Two documentation drifts surfaced by Copilot review on #420, both verified against the tree and live repository state. The 5D audit and validation sections referenced `configure.sh check` and `configure.sh apply`, subcommands the script does not implement. Its interface is `[owner/repo] [release|operational]`, so `check` would be parsed as a repository name and silently act on the wrong target rather than erroring. Auditing also moved to AUDIT.md as a read-only procedure; configure.sh now only applies. Point the audit references at AUDIT.md and describe configure.sh with its actual argument form. NUGET_USERNAME was documented as Actions-store-only while spec/secrets.json and AUDIT.md both claim the Actions and Dependabot stores. The fleet hub's canonical nuget-oidc mechanism declares both, and the live repository carries the name in both stores, so WORKFLOW.md was the outlier; align it and cite the spec it follows. Both drifts are local to this repo. ProjectTemplate's WORKFLOW.md has no configure.sh subcommand references and no NuGet publish, so neither needs an upstream fix. Co-Authored-By: Claude Opus 4.8 (1M context) --- WORKFLOW.md | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/WORKFLOW.md b/WORKFLOW.md index 0af2716..0e30cce 100644 --- a/WORKFLOW.md +++ b/WORKFLOW.md @@ -586,13 +586,13 @@ determined by NBGV from the checkout state in section 3.* ### 5D. Configuration audit -Run [`repo-config/configure.sh check`](./repo-config/) (section 6). It confirms the listed secrets exist, +Follow the read-only audit in [`AUDIT.md`](./AUDIT.md) (section 6). It confirms the listed secrets exist, the `main`/`develop` rulesets enforce the required merge method + status check + signed commits + -strict-off, and the repository settings (auto-merge, allowed merge methods) are in place, exiting non-zero -on any drift. A missing or incorrect configuration item is a defect (D10). Secret *values* cannot be read +strict-off, and the repository settings (auto-merge, allowed merge methods) are in place, reporting any +drift. A missing or incorrect configuration item is a defect (D10). Secret *values* cannot be read back, so the audit asserts the names exist (failing if it cannot query them); the GitHub App installation is a best-effort check (a precise check needs app-level auth, so it notes rather than fails). The NuGet.org trusted-publishing -policy (D4.7) lives outside GitHub and cannot be checked by `gh api`; the script flags it as a manual +policy (D4.7) lives outside GitHub and cannot be checked by `gh api`; the audit records it as a manual verification item. ### Assessment @@ -619,7 +619,9 @@ in its own right, not merely discoverable by failure (D10; audit 5D). **Secrets.** - `NUGET_USERNAME` - the NuGet.org profile name passed to `NuGet/login@v1` for OIDC trusted publishing - (D4.7). Actions store. **No `NUGET_API_KEY`** secret is used; publishing is keyless. + (D4.7). Required in **both** the Actions and Dependabot secret stores, matching the fleet hub's canonical + `nuget-oidc` mechanism that [`spec/secrets.json`](./spec/secrets.json) carries and [`AUDIT.md`](./AUDIT.md) + checks. **No `NUGET_API_KEY`** secret is used; publishing is keyless. - `CODEGEN_APP_CLIENT_ID` / `CODEGEN_APP_PRIVATE_KEY` - the GitHub App credentials the merge-bot mints the App token from. Required in **both** the Actions and Dependabot secret stores, because a merge-bot run on a Dependabot PR is given the Dependabot secret store, not Actions secrets. The App must be installed on @@ -655,8 +657,11 @@ first successful publish locks it to the repo and owner IDs. - The GitHub App installed with the scopes above. **Validation.** This configuration is codified in [`repo-config/`](./repo-config/): the branch rulesets -and repository settings as JSON, applied and audited by an idempotent `gh api` script. -`repo-config/configure.sh check` reads the live rulesets, settings, and secret names and exits non-zero -on any drift; that command **is** the 5D audit. `repo-config/configure.sh apply` configures a fresh repo -to match. Secret values cannot be read back, so the audit asserts the names exist (failing if they cannot be queried); +and repository settings as JSON, applied by an idempotent `gh api` script and audited read-only per +[`AUDIT.md`](./AUDIT.md). +[`AUDIT.md`](./AUDIT.md) diffs the live rulesets, settings, and secret names against the committed +baseline and reports drift without changing anything; that procedure **is** the 5D audit. +`repo-config/configure.sh [owner/repo] [release|operational]` applies the baseline to a repo (idempotent; +both arguments optional - the repo defaults to the current one and the model to the registry lookup). +Secret values cannot be read back, so the audit asserts the names exist (failing if they cannot be queried); the App installation is a best-effort check. From 2487a13c21274a4bf8684a1536642d49944f5557 Mon Sep 17 00:00:00 2001 From: Pieter Viljoen Date: Sat, 18 Jul 2026 10:39:12 -0700 Subject: [PATCH 2/2] Clarify NuGet policy is outside the audit and configure.sh model fallback Two accuracy fixes from Copilot review. The 5D section said the audit "records" the NuGet.org trusted-publishing policy as a manual item, but AUDIT.md does not mention that policy at all - it checks settings, rulesets, and secret names only. The previous wording attributed it to configure.sh, and rewording it to "the audit" moved the inaccurate claim onto AUDIT.md rather than removing it. State plainly that the policy sits outside the drift report as a manual checklist item. The configure.sh model argument note omitted the standalone case: with no registry file the script warns and defaults to release, rather than performing a registry lookup. Co-Authored-By: Claude Opus 4.8 (1M context) --- WORKFLOW.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/WORKFLOW.md b/WORKFLOW.md index 0e30cce..5c9b74f 100644 --- a/WORKFLOW.md +++ b/WORKFLOW.md @@ -592,8 +592,8 @@ strict-off, and the repository settings (auto-merge, allowed merge methods) are drift. A missing or incorrect configuration item is a defect (D10). Secret *values* cannot be read back, so the audit asserts the names exist (failing if it cannot query them); the GitHub App installation is a best-effort check (a precise check needs app-level auth, so it notes rather than fails). The NuGet.org trusted-publishing -policy (D4.7) lives outside GitHub and cannot be checked by `gh api`; the audit records it as a manual -verification item. +policy (D4.7) lives outside GitHub and cannot be checked by `gh api`, so it sits outside AUDIT.md's drift +report entirely - it is a manual checklist item, verified on NuGet.org (see section 6). ### Assessment @@ -662,6 +662,7 @@ and repository settings as JSON, applied by an idempotent `gh api` script and au [`AUDIT.md`](./AUDIT.md) diffs the live rulesets, settings, and secret names against the committed baseline and reports drift without changing anything; that procedure **is** the 5D audit. `repo-config/configure.sh [owner/repo] [release|operational]` applies the baseline to a repo (idempotent; -both arguments optional - the repo defaults to the current one and the model to the registry lookup). +both arguments optional - the repo defaults to the current one, and the model to the registry lookup, +falling back to `release` with a warning when no registry is present). Secret values cannot be read back, so the audit asserts the names exist (failing if they cannot be queried); the App installation is a best-effort check.