Skip to content

fix: no build env var shares a name with a secret id (1.39.4, RT#1550) #121

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fatherlinux merged 1 commit into from
Nov 11, 2026
Merged

fix: no build env var shares a name with a secret id (1.39.4, RT#1550) #121

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 13 additions & 10 deletions .github/workflows/container-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
#
# Callers pin this file to a release tag; copy examples/container.yml:
#
# uses: crunchtools/constitution/.github/workflows/[email protected].3
# uses: crunchtools/constitution/.github/workflows/[email protected].4
#
# One build per change. A pull request builds its head commit, gates that
# digest and marks it gated-<sha>. The merge to the default branch does NOT
Expand Down Expand Up @@ -175,7 +175,7 @@ jobs:
- uses: actions/checkout@v7
with:
repository: crunchtools/constitution
ref: ${{ inputs.constitution-ref || 'v1.39.3' }}
ref: ${{ inputs.constitution-ref || 'v1.39.4' }}
path: .constitution
persist-credentials: false
- id: r
Expand Down Expand Up @@ -222,8 +222,11 @@ jobs:
FORMAT: ${{ inputs.format }}
SOURCE: ${{ github.server_url }}/${{ github.repository }}
RHSM: ${{ inputs.rhsm }}
RHSM_ACTIVATION_KEY: ${{ secrets.RHSM_ACTIVATION_KEY }}
RHSM_ORG_ID: ${{ secrets.RHSM_ORG_ID }}
# Not named after the secret ids: podman 4.9 (the runner's) mounts
# a secret whose id matches an environment variable empty, ignoring
# src=, which failed every id=RHSM_ACTIVATION_KEY build.
RHSM_KEY_VALUE: ${{ secrets.RHSM_ACTIVATION_KEY }}
RHSM_ORG_VALUE: ${{ secrets.RHSM_ORG_ID }}
REDHAT_REGISTRY: ${{ inputs.redhat-registry }}
RH_USER: ${{ secrets.REGISTRY_REDHAT_IO_USER }}
RH_PASSWORD: ${{ secrets.REGISTRY_REDHAT_IO_PASSWORD }}
Expand All @@ -238,10 +241,10 @@ jobs:
if [ "$RHSM" = true ]; then
# Files, not env=: the runner's podman predates env-sourced secrets.
# 0600 in RUNNER_TEMP, removed below; the gates job never sees them.
[ -n "$RHSM_ACTIVATION_KEY" ] || { echo "rhsm: true but no RHSM_ACTIVATION_KEY" >&2; exit 1; }
[ -n "$RHSM_KEY_VALUE" ] || { echo "rhsm: true but no RHSM_ACTIVATION_KEY" >&2; exit 1; }
umask 077
printf '%s' "$RHSM_ACTIVATION_KEY" > "$RUNNER_TEMP/activation_key"
printf '%s' "$RHSM_ORG_ID" > "$RUNNER_TEMP/org_id"
printf '%s' "$RHSM_KEY_VALUE" > "$RUNNER_TEMP/activation_key"
printf '%s' "$RHSM_ORG_VALUE" > "$RUNNER_TEMP/org_id"
# Both spellings are in the fleet's Containerfiles: id=activation_key
# (rotv, nagios, rt) and id=RHSM_ACTIVATION_KEY (the ubi10 mariadb
# and postgres images). An unused secret costs nothing.
Expand Down Expand Up @@ -314,7 +317,7 @@ jobs:
- uses: actions/checkout@v7
with:
repository: crunchtools/constitution
ref: ${{ inputs.constitution-ref || 'v1.39.3' }}
ref: ${{ inputs.constitution-ref || 'v1.39.4' }}
path: .constitution
persist-credentials: false
- if: needs.build.outputs.pushed == 'false'
Expand Down Expand Up @@ -400,7 +403,7 @@ jobs:
- uses: actions/checkout@v7
with:
repository: crunchtools/constitution
ref: ${{ inputs.constitution-ref || 'v1.39.3' }}
ref: ${{ inputs.constitution-ref || 'v1.39.4' }}
path: .constitution
persist-credentials: false
- env:
Expand Down Expand Up @@ -436,7 +439,7 @@ jobs:
- uses: actions/checkout@v7
with:
repository: crunchtools/constitution
ref: ${{ inputs.constitution-ref || 'v1.39.3' }}
ref: ${{ inputs.constitution-ref || 'v1.39.4' }}
path: .constitution
persist-credentials: false
- id: p
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/dependency-audit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
# permissions:
# contents: read
# issues: write
# uses: crunchtools/constitution/.github/workflows/[email protected].3
# uses: crunchtools/constitution/.github/workflows/[email protected].4
#
# from a workflow that runs on pull_request, on push to the default branch and on
# a weekly schedule. A pull request with a vulnerable dependency fails. On the
Expand Down Expand Up @@ -43,7 +43,7 @@ jobs:
- uses: actions/checkout@v7
with:
repository: crunchtools/constitution
ref: v1.39.3
ref: v1.39.4
path: .constitution
persist-credentials: false
- name: Install uv
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/validate.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
#
# Callers pin this file to a release tag:
#
# uses: crunchtools/constitution/.github/workflows/[email protected].3
# uses: crunchtools/constitution/.github/workflows/[email protected].4
#
# That tag IS the version the repo is judged by: the validator, profiles and
# requirements.toml are checked out at the release this file belongs to,
Expand Down Expand Up @@ -37,7 +37,7 @@ jobs:
- uses: actions/checkout@v7
with:
repository: crunchtools/constitution
ref: v1.39.3
ref: v1.39.4

@github-actions github-actions Bot Nov 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

HIGH (Constitution): The self-validation workflow now checks out the candidate v1.39.4 validator. The constitution requires this repo's required check to pin validate.yml to the last release so a PR is not judged by the validator it changes.

Suggestion: Keep the checkout pinned to the previous release while this change is under review; update it to v1.39.4 after that release, as required by the self-validation process.

Evidence:

ref: v1.39.4

@fatherlinux fatherlinux Nov 11, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not a bug: this repo's required self-check is .github/workflows/constitution.yml, which calls [email protected], a past release, so this PR is not judged by the validator it changes. The ref: literal inside validate.yml is the release that file belongs to: callers pinning [email protected] must check out the v1.39.4 validator, and tests hold that literal equal to the version. v1.39.2 and v1.39.3 shipped the same way.

path: .constitution
persist-credentials: false
- uses: actions/setup-python@v7
Expand Down
10 changes: 10 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,16 @@ Entries through 1.14.0 are derived from the Ratification History table in

## [Unreleased]

## [1.39.4] - 2026-11-11

### Fixed

- `rhsm: true` builds whose Containerfile mounts `id=RHSM_ACTIVATION_KEY`
(the ubi10 mariadb and postgres images) got an empty secret: the runner's
podman 4.9 mounts a secret whose id matches an environment variable
empty, ignoring `src=`, and the build step exported the key under that
name. The build step's variables are renamed, and a test holds that no build env var shares a secret id.

## [1.39.3] - 2026-11-11

### Fixed
Expand Down
2 changes: 1 addition & 1 deletion constitution.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# CrunchTools Constitution

> **Version:** 1.39.3
> **Version:** 1.39.4
> **Ratified:** 2026-11-04
> **Status:** Active

Expand Down
2 changes: 1 addition & 1 deletion examples/constitution.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,4 +18,4 @@ permissions:
jobs:
constitution:
name: Constitution
uses: crunchtools/constitution/.github/workflows/[email protected].3
uses: crunchtools/constitution/.github/workflows/[email protected].4
2 changes: 1 addition & 1 deletion examples/container.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ permissions: {}

jobs:
container:
uses: crunchtools/constitution/.github/workflows/[email protected].3
uses: crunchtools/constitution/.github/workflows/[email protected].4
permissions:
contents: read
pull-requests: read
Expand Down
2 changes: 1 addition & 1 deletion examples/security.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,4 +24,4 @@ jobs:
permissions:
contents: read
issues: write
uses: crunchtools/constitution/.github/workflows/[email protected].3
uses: crunchtools/constitution/.github/workflows/[email protected].4
2 changes: 1 addition & 1 deletion tests/test_cascade.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ def test_a_direct_dispatch_counts():

CALLER = (
"jobs:\n container:\n"
" uses: crunchtools/constitution/.github/workflows/[email protected].3\n"
" uses: crunchtools/constitution/.github/workflows/[email protected].4\n"
" with:\n cascade: true\n downstream: child other-child\n"
)

Expand Down
13 changes: 13 additions & 0 deletions tests/test_manifest.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -219,6 +219,19 @@ def test_rhsm_passes_both_secret_ids_from_the_same_files():
assert "--secret" in rhsm_block and "--secret" not in run.split('if [ "$RHSM"', 1)[0]


def test_no_build_env_var_shares_a_name_with_a_secret_id():
"""podman 4.9 mounts a secret whose id matches an env var empty (src= is
ignored): every id=RHSM_ACTIVATION_KEY build failed while the env carried
RHSM_ACTIVATION_KEY."""
import yaml

workflow = yaml.safe_load((ROOT / ".github/workflows/container-release.yml").read_text())
build = next(s for s in workflow["jobs"]["build"]["steps"] if s.get("name") == "Build once")
ids = set(re.findall(r'--secret "id=([A-Za-z_]+),', build["run"]))
assert ids >= {"RHSM_ACTIVATION_KEY", "activation_key"}
assert ids.isdisjoint(build.get("env", {}))


def test_container_release_inputs_parse_and_dispatch_the_configured_event():
"""Parsed, not grepped: every input has one type, and the dispatch step sends
the `downstream-event` input, which defaults to the profile's event name."""
Expand Down
Loading