Skip to content

fix: restrict cross-repo release gate token to push #600

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
YoneRai12 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: restrict cross-repo release gate token to push #600

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/quality-wall.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -338,6 +338,7 @@ jobs:
--github-prerelease auto
fi
- name: Run v0.23 cross-repo release gate snapshot
if: ${{ github.event_name == 'push' }}
env:
GH_TOKEN: ${{ secrets.YONERAI_RELEASE_GATE_TOKEN || github.token }}
run: |
Expand Down
17 changes: 17 additions & 0 deletions tests/test_quality_wall_workflow.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

from pathlib import Path

import yaml

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add the PyYAML dependency or avoid the yaml import

In the checked release-gate workflow path, dependencies are installed with python -m pip install -e clients/cli pytest, and neither that package nor the requirements used by this job declare PyYAML; this new top-level import makes python -m pytest tests/test_quality_wall_workflow.py -q fail during collection with ModuleNotFoundError: No module named 'yaml'. Please either keep this test on stdlib/string checks or install/declare PyYAML for the job that runs it.

Useful? React with 👍 / 👎.



WORKFLOW = Path(".github/workflows/quality-wall.yml")
REQUIRED_CHECKS = Path("docs/process/REQUIRED_CHECKS.md")
Expand Down Expand Up @@ -58,6 +60,21 @@ def test_release_gate_workflow_does_not_publish() -> None:
assert "releases/manifest|docs/releases/" not in workflow


def test_cross_repo_release_gate_token_is_not_exposed_to_pull_request_code() -> None:
workflow = yaml.safe_load(WORKFLOW.read_text(encoding="utf-8"))

release_gate_steps = workflow["jobs"]["release-gate"]["steps"]
cross_repo_gate_step = next(
step
for step in release_gate_steps
if step.get("name") == "Run v0.23 cross-repo release gate snapshot"
)
Comment on lines +67 to +71

@gemini-code-assist gemini-code-assist Bot Jul 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Using next() on a generator expression without a default value will raise a StopIteration exception if the step is not found. In a test environment, this results in an uninformative test error rather than a clear assertion failure. Providing a default value of None and asserting that the step is not None makes the test failure much more diagnostic and easier to debug.

Suggested change
cross_repo_gate_step = next(
step
for step in release_gate_steps
if step.get("name") == "Run v0.23 cross-repo release gate snapshot"
)
cross_repo_gate_step = next(
(step for step in release_gate_steps if step.get("name") == "Run v0.23 cross-repo release gate snapshot"),
None,
)
assert cross_repo_gate_step is not None, "Step 'Run v0.23 cross-repo release gate snapshot' not found in workflow"


assert cross_repo_gate_step["if"] == "${{ github.event_name == 'push' }}"
assert cross_repo_gate_step["env"]["GH_TOKEN"] == "${{ secrets.YONERAI_RELEASE_GATE_TOKEN || github.token }}"
assert "python scripts/yonerai_release_gate.py --release-issue 592" in cross_repo_gate_step["run"]


def test_required_checks_doc_lists_quality_wall_jobs() -> None:
doc = REQUIRED_CHECKS.read_text(encoding="utf-8")

Expand Down
Loading