feat(repo-settings): release environment for the ccf-release-bot secrets

.github/workflows/attention-digest.yml

@@ -31,6 +31,9 @@ jobs:
   digest:
     name: digest
     runs-on: ubuntu-latest
+    # This repo's release environment holds the ccf-release-bot secrets; only main may use it
+    # (repo-settings), so a workflow on another branch can't read them.
+    environment: release
     timeout-minutes: 15
     env:
       # A scheduled run has no inputs: keep this fallback equal to the input's default.

.github/workflows/ccf-bump-merge.yml

@@ -31,6 +31,9 @@ jobs:
   merge:
     name: merge
     runs-on: ubuntu-latest
+    # This repo's release environment holds the ccf-release-bot secrets; only main may use it
+    # (repo-settings), so a workflow on another branch can't read them.
+    environment: release
     timeout-minutes: 15
     env:
       # A scheduled run has no inputs: keep this fallback equal to the input's default.

.github/workflows/ccf-bump-sync.yml

@@ -31,6 +31,9 @@ jobs:
   sync:
     name: sync
     runs-on: ubuntu-latest
+    # This repo's release environment holds the ccf-release-bot secrets; only main may use it
+    # (repo-settings), so a workflow on another branch can't read them.
+    environment: release
     # --batch 10 waits an hour after every 10 PRs.
     timeout-minutes: 300
     steps:

.github/workflows/ci.yml

@@ -69,7 +69,8 @@ jobs:
 
   # The ccf-required ruleset (repo-settings) requires the check `ci / required`, which a caller's
   # `ci` job gets from the kind workflows' `required` job. This repo calls no kind workflow, so the
-  # job carries that name itself. The same check as the kind workflows: anything but success fails.
+  # job carries that name itself. Anything but success fails, except release-checks being skipped:
+  # it only runs on release-please PRs, and a called workflow whose jobs all skip reports skipped.
   required:
     name: ci / required
     needs: [go, actionlint, release-checks]
@@ -82,7 +83,8 @@ jobs:
         env:
           NEEDS: ${{ toJSON(needs) }}
         run: |
-          failed="$(jq -r 'to_entries[] | select(.value.result != "success") | "\(.key): \(.value.result)"' <<< "$NEEDS")"
+          failed="$(jq -r 'to_entries[] | select(.value.result != "success")
+            | select(.key != "release-checks" or .value.result != "skipped") | "\(.key): \(.value.result)"' <<< "$NEEDS")"
           if [ -n "$failed" ]; then
             echo "::error::required jobs did not succeed:"
             echo "$failed"

.github/workflows/cut-prerelease.yml

@@ -17,11 +17,11 @@ on:
         default: v
     secrets:
       RELEASE_BOT_APP_ID:
-        description: "ccf-release-bot App ID"
-        required: true
+        description: "ccf-release-bot App ID (the caller\'s `release` environment secret is used first)"
+        required: false
       RELEASE_BOT_PRIVATE_KEY:
-        description: "ccf-release-bot private key"
-        required: true
+        description: "ccf-release-bot private key (the caller\'s `release` environment secret is used first)"
+        required: false
     outputs:
       tag:
         description: "The release-candidate tag created"
@@ -33,6 +33,9 @@ jobs:
   cut:
     name: cut
     runs-on: ubuntu-latest
+    # The caller's release environment holds the ccf-release-bot secrets; only the default branch
+    # and release tags may use it (repo-settings), so a workflow on another branch can't read them.
+    environment: release
     timeout-minutes: 10
     permissions:
       contents: read

.github/workflows/release-action.yml

@@ -13,11 +13,11 @@ on:
         default: v
     secrets:
       RELEASE_BOT_APP_ID:
-        description: "ccf-release-bot App ID"
-        required: true
+        description: "ccf-release-bot App ID (the caller\'s `release` environment secret is used first)"
+        required: false
       RELEASE_BOT_PRIVATE_KEY:
-        description: "ccf-release-bot private key"
-        required: true
+        description: "ccf-release-bot private key (the caller\'s `release` environment secret is used first)"
+        required: false
 
 permissions: {}
 

.github/workflows/release-finished.yml

@@ -17,11 +17,11 @@ on:
         default: '[{}]'
     secrets:
       RELEASE_BOT_APP_ID:
-        description: "ccf-release-bot App ID"
-        required: true
+        description: "ccf-release-bot App ID (the caller\'s `release` environment secret is used first)"
+        required: false
       RELEASE_BOT_PRIVATE_KEY:
-        description: "ccf-release-bot private key"
-        required: true
+        description: "ccf-release-bot private key (the caller\'s `release` environment secret is used first)"
+        required: false
 
 permissions: {}
 
@@ -30,6 +30,9 @@ jobs:
     name: dispatch
     if: always() # also when the run is cancelled
     runs-on: ubuntu-latest
+    # The caller's release environment holds the ccf-release-bot secrets; only the default branch
+    # and release tags may use it (repo-settings), so a workflow on another branch can't read them.
+    environment: release
     timeout-minutes: 10
     permissions: {}
     env:

.github/workflows/release-go-image.yml

@@ -18,11 +18,11 @@ on:
         default: v
     secrets:
       RELEASE_BOT_APP_ID:
-        description: "ccf-release-bot App ID"
-        required: true
+        description: "ccf-release-bot App ID (the caller\'s `release` environment secret is used first)"
+        required: false
       RELEASE_BOT_PRIVATE_KEY:
-        description: "ccf-release-bot private key"
-        required: true
+        description: "ccf-release-bot private key (the caller\'s `release` environment secret is used first)"
+        required: false
 
 permissions: {}
 

.github/workflows/release-go-lib.yml

@@ -10,11 +10,11 @@ on:
   workflow_call:
     secrets:
       RELEASE_BOT_APP_ID:
-        description: "ccf-release-bot App ID"
-        required: true
+        description: "ccf-release-bot App ID (the caller\'s `release` environment secret is used first)"
+        required: false
       RELEASE_BOT_PRIVATE_KEY:
-        description: "ccf-release-bot private key"
-        required: true
+        description: "ccf-release-bot private key (the caller\'s `release` environment secret is used first)"
+        required: false
 
 permissions: {}
 

.github/workflows/release-go-plugin.yml

@@ -20,11 +20,11 @@ on:
         default: "2"
     secrets:
       RELEASE_BOT_APP_ID:
-        description: "ccf-release-bot App ID"
-        required: true
+        description: "ccf-release-bot App ID (the caller\'s `release` environment secret is used first)"
+        required: false
       RELEASE_BOT_PRIVATE_KEY:
-        description: "ccf-release-bot private key"
-        required: true
+        description: "ccf-release-bot private key (the caller\'s `release` environment secret is used first)"
+        required: false
 
 permissions: {}
 

.github/workflows/release-helm.yml

@@ -18,11 +18,11 @@ on:
         default: oci://ghcr.io/compliance-framework/helm-charts
     secrets:
       RELEASE_BOT_APP_ID:
-        description: "ccf-release-bot App ID"
-        required: true
+        description: "ccf-release-bot App ID (the caller\'s `release` environment secret is used first)"
+        required: false
       RELEASE_BOT_PRIVATE_KEY:
-        description: "ccf-release-bot private key"
-        required: true
+        description: "ccf-release-bot private key (the caller\'s `release` environment secret is used first)"
+        required: false
 
 permissions: {}
 

.github/workflows/release-please.yml

@@ -7,11 +7,11 @@ on:
   workflow_call:
     secrets:
       RELEASE_BOT_APP_ID:
-        description: "ccf-release-bot App ID"
-        required: true
+        description: "ccf-release-bot App ID (the caller\'s `release` environment secret is used first)"
+        required: false
       RELEASE_BOT_PRIVATE_KEY:
-        description: "ccf-release-bot private key"
-        required: true
+        description: "ccf-release-bot private key (the caller\'s `release` environment secret is used first)"
+        required: false
     outputs:
       releases-created:
         description: "true when this run created at least one release"
@@ -26,6 +26,9 @@ jobs:
   release-please:
     name: release-please
     runs-on: ubuntu-latest
+    # The caller's release environment holds the ccf-release-bot secrets; only the default branch
+    # and release tags may use it (repo-settings), so a workflow on another branch can't read them.
+    environment: release
     timeout-minutes: 10
     permissions:
       contents: read # check out release-please-config.json for the defaults check

.github/workflows/release-policies.yml

@@ -22,11 +22,11 @@ on:
         default: v
     secrets:
       RELEASE_BOT_APP_ID:
-        description: "ccf-release-bot App ID"
-        required: true
+        description: "ccf-release-bot App ID (the caller\'s `release` environment secret is used first)"
+        required: false
       RELEASE_BOT_PRIVATE_KEY:
-        description: "ccf-release-bot private key"
-        required: true
+        description: "ccf-release-bot private key (the caller\'s `release` environment secret is used first)"
+        required: false
 
 permissions: {}
 

.github/workflows/release-ui.yml

@@ -16,11 +16,11 @@ on:
         default: v
     secrets:
       RELEASE_BOT_APP_ID:
-        description: "ccf-release-bot App ID"
-        required: true
+        description: "ccf-release-bot App ID (the caller\'s `release` environment secret is used first)"
+        required: false
       RELEASE_BOT_PRIVATE_KEY:
-        description: "ccf-release-bot private key"
-        required: true
+        description: "ccf-release-bot private key (the caller\'s `release` environment secret is used first)"
+        required: false
 
 permissions: {}
 

.github/workflows/renovate.yml

@@ -41,6 +41,9 @@ jobs:
   renovate:
     name: renovate
     runs-on: ubuntu-latest
+    # This repo's release environment holds the ccf-release-bot secrets; only main may use it
+    # (repo-settings), so a workflow on another branch can't read them.
+    environment: release
     timeout-minutes: 60
     env:
       # A scheduled run has no inputs: keep these fallbacks equal to the dispatch defaults.

.github/workflows/repo-settings.yml

@@ -1,8 +1,11 @@
 name: repo-settings
 
-# Brings the manifest repos' merge settings, security settings, Actions settings and rulesets to the
-# desired state (internal/reposettings). Prints a per-repo diff; writes only with apply: true, which a human runs
-# after granting ccf-repo-admin Administration write (README: "Repo settings").
+# Brings the manifest repos' merge settings, security settings, Actions settings, rulesets and
+# release environments (with the ccf-release-bot secrets) to the desired state
+# (internal/reposettings). Prints a per-repo diff; writes only with apply: true, from main. The
+# job runs in this repo's repo-admin environment: its secrets (ccf-repo-admin's key and the
+# ccf-release-bot secrets it copies) are released only to a run on main a reviewer approves
+# (README: "Repo settings").
 
 on:
   workflow_dispatch:
@@ -28,6 +31,10 @@ on:
         description: Status check context the ccf-required ruleset requires
         type: string
         default: ci / required
+      rotate-secrets:
+        description: Rewrite every release environment secret, not only missing ones (after a key rotation)
+        type: boolean
+        default: false
 
 permissions:
   contents: read
@@ -40,6 +47,10 @@ jobs:
   sync:
     name: sync
     runs-on: ubuntu-latest
+    # Holds REPO_ADMIN_APP_ID/REPO_ADMIN_PRIVATE_KEY and the RELEASE_BOT_APP_ID/RELEASE_BOT_PRIVATE_KEY
+    # values copied into each repo's release environment. Main only, with required reviewers:
+    # ccf-repo-admin keeps Administration write, so its key must not reach any other run.
+    environment: repo-admin
     timeout-minutes: 15
     steps:
       - name: Only apply from main
@@ -74,6 +85,8 @@ jobs:
           owner: compliance-framework
           repositories: ${{ steps.select.outputs.repos }}
           permission-administration: ${{ inputs.apply && 'write' || 'read' }}
+          permission-actions: read # environments and their deployment policies
+          permission-environments: ${{ inputs.apply && 'write' || 'read' }} # environment secrets
       - name: Sync repo settings
         env:
           GH_TOKEN: ${{ steps.token.outputs.token }}
@@ -82,6 +95,10 @@ jobs:
           APPLY: ${{ inputs.apply }}
           BYPASS_APP_ID: ${{ inputs.release-bot-app-id || vars.RELEASE_BOT_APP_ID }}
           REQUIRED_CHECK: ${{ inputs.required-check }}
+          ROTATE_SECRETS: ${{ inputs.rotate-secrets }}
+          # The values written to the release environments; a dry run doesn't get them.
+          RELEASE_BOT_APP_ID: ${{ inputs.apply && secrets.RELEASE_BOT_APP_ID || '' }}
+          RELEASE_BOT_PRIVATE_KEY: ${{ inputs.apply && secrets.RELEASE_BOT_PRIVATE_KEY || '' }}
         run: |
           go run ./cmd/repo-settings sync --manifest "$MANIFEST" --repos "$REPOS" --apply="$APPLY" \
-            --bypass-app-id "$BYPASS_APP_ID" --required-check "$REQUIRED_CHECK"
+            --bypass-app-id "$BYPASS_APP_ID" --required-check "$REQUIRED_CHECK" --rotate-secrets="$ROTATE_SECRETS"

.github/workflows/train.yml

@@ -48,6 +48,10 @@ jobs:
         startsWith(github.event.comment.body, '/') &&
         github.event.comment.user.type != 'Bot')
     runs-on: ubuntu-latest
+    # This repo's release environment holds the ccf-release-bot secrets; only main may use it
+    # (repo-settings), so a workflow on another branch can't read them. Comments, schedules and
+    # repository_dispatch run on main.
+    environment: release
     timeout-minutes: 60
     # One run at a time, at the job level so that skipped runs (other comments) don't queue.
     # GitHub keeps one pending run and cancels older pending ones; every run reads the state and

.github/workflows/vuln-summary.yml

@@ -26,6 +26,9 @@ jobs:
   summary:
     name: summary
     runs-on: ubuntu-latest
+    # This repo's release environment holds the ccf-release-bot secrets; only main may use it
+    # (repo-settings), so a workflow on another branch can't read them.
+    environment: release
     timeout-minutes: 10
     env:
       # A scheduled run has no inputs: keep this fallback equal to the input's default.