Skip to content

security: stop exposing AUDIT_KEYPAIR_SECRET on pull_request workflows - #365

Open
samkay-ops wants to merge 3 commits into
Vero-protocol:mainfrom
samkay-ops:fix/issue-remove-secret-from-pr-workflow
Open

security: stop exposing AUDIT_KEYPAIR_SECRET on pull_request workflows#365
samkay-ops wants to merge 3 commits into
Vero-protocol:mainfrom
samkay-ops:fix/issue-remove-secret-from-pr-workflow

Conversation

@samkay-ops

@samkay-ops samkay-ops commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes #342 — policy-compliance.yml injected AUDIT_KEYPAIR_SECRET and ANCHOR_ON_CHAIN into PR-triggered jobs, exposing the anchoring signing secret to unreviewed PR code.

Changes

  • Remove AUDIT_KEYPAIR_SECRET and ANCHOR_ON_CHAIN from both env blocks in .github/workflows/policy-compliance.yml
  • Leave anchoring only in anchor-on-merge.yml (protected production-anchor environment)

Acceptance criteria

  • AUDIT_KEYPAIR_SECRET no longer appears in policy-compliance.yml
  • Policy evaluation path unchanged aside from removed secret exposure

Closes #342

@samkay-ops
samkay-ops requested a review from N-thnI as a code owner August 24, 2026 20:46
@N-thnI

N-thnI commented Aug 27, 2026

Copy link
Copy Markdown
Contributor

This branch now conflicts with main. Could you rebase onto the latest main and resolve the conflicts? Happy to merge once it's clean.

@N-i-xx N-i-xx mentioned this pull request Aug 27, 2026
Open
2 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@N-thnI N-thnI N-thnI approved these changes
@N-i-xx N-i-xx N-i-xx approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Remove AUDIT_KEYPAIR_SECRET and ANCHOR_ON_CHAIN from the pull_request-triggered policy workflow

3 participants

@samkay-ops @N-thnI @N-i-xx