ci: registry ops — drop the debug workflow, pin an auth-capable CLI, add publisher setup - #31
Merged
Conversation
The registry publish 401s at the edge upload: it authenticates with a hub-identity verifiable presentation, and CI holds no HALO identity to produce one. The CLI (dxos/dxos) now accepts DX_HUB_API_KEY and sends it as X-Admin-Key in place of the VP flow, so the release passes the secret through. Also lets a dispatch override the pinned CLI (`cli_package`), so a pkg.pr.new branch build can be tested against the real edge before landing in dxos, and teaches the debug workflow to probe /registry/upload with the key — whether the server honors X-Admin-Key on that route is not observable from this repo. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01SZ4ZdaPo9erkh5yF4eXh3Z
Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01SZ4ZdaPo9erkh5yF4eXh3Z
The auth question the debug workflow existed to answer is settled: edge accepts the admin key on /registry/upload (dxos/edge#822) and the full registry publish succeeded with it. The CLI pin moves to a build that sends DX_HUB_API_KEY (dxos/dxos#12528); the previous pin predates that support and would still 401. Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01SZ4ZdaPo9erkh5yF4eXh3Z
Bootstraps the ATProto publisher account's records — publisher.profile and an optional self-authored publisher.verification — so a publisher change is a secrets rotation plus one dispatch. Not part of the release flow; the verification only affects discovery where this account is the configured curator (currently production). Co-Authored-By: Claude Opus 5 <[email protected]> Claude-Session: https://claude.ai/code/session_01SZ4ZdaPo9erkh5yF4eXh3Z
wittjosiah
changed the title
wittjosiah
marked this pull request as ready for review
August 9, 2026 12:29
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The registry publish now works end-to-end — Release run (
registry_only, CLI@1edc570) published[email protected]to the production registry, authenticating the edge upload withDX_HUB_API_KEY— so this PR retires the debugging scaffolding and finishes the ops story around the publisher account.debug-registry-auth.yml(marked TEMPORARY from birth). Its final runs confirmed the ATProto secrets are valid (createSession200) and that edge accepts the admin key on/registry/uploadafter dxos/edge#822 (unauthenticated 401 → keyed 400 on main + production, bothX-Admin-Keyand canonicalAuthorization: Bearer).ba08e65→1edc570: the old pin predatesDX_HUB_API_KEYsupport indx registry publish(edge-client: authenticate registry uploads with DX_HUB_API_KEY dxos#12528), so a real Version-Packages release with it would still 401 on the upload.setup-publisher.yml— a one-time, dispatch-only bootstrap for the publisher account's ATProto records (publisher.profile+ optional self-authoredpublisher.verification). Changing the publisher becomes: rotate theATPROTO_*secrets, dispatch once. Clearly labeled as not part of the release flow; the self-verification note explains it only affects discovery where the publisher account is the configured curator (REGISTRY_CURATOR_DID— currently true in production only).Changeset
None — CI-only change.