hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions

Remove Python dependency from secret decrypt
Some checks failed
Build Rust / Cargo Test (push) Successful in 3m59s
Details
Build Site / Next.js Build (push) Failing after 5s
Details
Lint Governance / BEP Metadata (push) Successful in 1s
Details

Browse source
This commit is contained in:
Conrad Kramer 2026-06-07 12:13:20 -07:00
parent ef7023f9be
commit 5ef4fdef64
2 changed files with 15 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

3
evolution/proposals/BEP-0009-release-infrastructure-and-store-upload-pipeline.md
View file

@ -79,7 +79,8 @@ The same change also makes the forge itself the release authority: release tags
bootstrap step. Linux Namespace signing jobs install Nix at runtime, so the
bootstrap writes Nix profile directories to `GITHUB_PATH`, the decrypt action
resolves Nix from those profile paths, and the action builds `.#age` before
falling back to `.#agenix`.
falling back to `.#agenix`. The decrypt step must not require Python before
the Nix CI shell is active.
- Produce unsigned Apple validation artifacts when signing is absent, but require signing for an App Store requested iOS release and for a Sparkle tester release. Uploadable artifacts are produced only after provisioning profiles can be synced from App Store Connect credentials and the relevant Apple certificate is proven to match the selected Google KMS key.
- Resolve release credentials through age/agenix before signed Apple lanes run. Forgejo secrets should carry only the runner age identity fallback and the Authentik WIF client secret until OpenBao can mint the runner token directly. App Store Connect keys and signing certificates live as sealed files under `secrets/`.
- Persist the forge runner SSH key as `/var/lib/forgejo-runner-agent/age_keystore` and export `BURROW_RUNNER_AGE_IDENTITY_PATH` so jobs can resolve agenix identities without embedding long-lived material in every workflow.