hanzoai/control
2
0
Fork 0
mirror of https://github.com/hanzoai/control.git synced 2026-09-30 20:56:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

the publish credential comes from KMS

Browse Source 
A registry token held as a forge secret is a second home for one thing, and the
one that rots unwatched. Only the KMS machine identity stays on the forge; the
token is read at publish time, from the surface every other Hanzo credential
already comes from.


Co-authored-by: Hanzo Dev <[email protected]>
This commit is contained in:
zeekay
2026-09-16 02:36:41 -07:00
co-authored by Hanzo Dev
parent cb6b48979e
commit ff8d196a88
1 changed files with 24 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.hanzo/workflows/publish.yml
+24 -1
View File
@@ -35,8 +35,31 @@ jobs:
- name: Publish if the tree is ahead of npmjs
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
KMS_CLIENT_ID: ${{ secrets.KMS_CLIENT_ID }}
KMS_CLIENT_SECRET: ${{ secrets.KMS_CLIENT_SECRET }}
run: |
# Only the KMS machine identity lives as a forge secret. A registry
# token beside it would be a second home for one thing, and the one
# that rots unwatched — nothing reads it until a release day.
if [ -z "${KMS_CLIENT_ID:-}" ] || [ -z "${KMS_CLIENT_SECRET:-}" ]; then
echo "::error::KMS machine identity absent — cannot pull the npm credential. Seed KMS_CLIENT_ID/KMS_CLIENT_SECRET as git.hanzo.ai Actions secrets (org or repo scope)." >&2
exit 1
fi
KMS=https://kms.hanzo.ai; ENVN=prod
KT=$(curl -sf "$KMS/v1/kms/auth/login" -H 'Content-Type: application/json' \
-d "{\"clientId\":\"$KMS_CLIENT_ID\",\"clientSecret\":\"$KMS_CLIENT_SECRET\"}" | jq -r .accessToken)
[ -n "$KT" ] && [ "$KT" != null ] || { echo "::error::KMS login failed"; exit 1; }
URL="$KMS/v1/kms/secrets/NPM_TOKEN?env=$ENVN"
BODY=$(curl -s -w '\n%{http_code}' "$URL" -H "Authorization: Bearer $KT") || true
CODE=$(printf '%s' "$BODY" | tail -1)
NODE_AUTH_TOKEN=$(printf '%s' "$BODY" | sed '$d' | jq -r '.value // empty' 2>/dev/null || true)
if [ -z "$NODE_AUTH_TOKEN" ]; then
echo "::error::KMS returned HTTP $CODE for $URL with no value — seed NPM_TOKEN there, not as a forge secret." >&2
exit 1
fi
echo "::add-mask::$NODE_AUTH_TOKEN"
export NODE_AUTH_TOKEN
NAME=$(jq -r .name package.json)
NEW=$(jq -r .version package.json)
OLD=$(curl -sf "https://registry.npmjs.org/${NAME}" \