chadtmiller.com/knotless

Switch repository

Loading…

What changes

KNOTLESS_BOT_DIDS on knotless.dev names ci.knotless.dev, the account the prod host's knotless-run now runs as, in place of the owner's DID, and adds the reviewer, review.knotless.dev. Each may log in at /oauth/bot for a session that reads private repositories; the owner's account no longer may.

Why

The runner that lands chadtmiller.com/knotless's merge queue and checks main ran as the owner's account, so its pushes and merges read as the owner's. It now runs as its own account, ci.knotless.dev, first among the repository's runners, with the owner's dropped. The reviewer's login there was a step its guide asks for that was never taken.

How it was checked

The runner already runs as ci.knotless.dev with its app password: it watches the repository and writes its checks there. Nothing else reads this list.

Shortcomings

Until ci.knotless.dev and review.knotless.dev log in at /oauth/bot, both read public repositories only, which is all they are asked to now.

This changes KNOTLESS_BOT_DIDS in deploy.yml. It swaps the owner's DID for ci.knotless.dev's and adds review.knotless.dev's, keeping the triager's DID. The change is small, and the comment matches it. I found nothing wrong with it.

I couldn't confirm that the two new DIDs (did:plc:ejh2v3z5ieqhqgz3ybk6r35x and did:plc:kqi2glvzerg4dt66k64co2sl) belong to ci.knotless.dev and review.knotless.dev. Neither appears anywhere else in the repository. Please check them against the handles' DID resolution before merging. A wrong DID would just leave that bot with public-only access, so a mistake would be easy to fix.

Dropping the owner's DID also means the owner can no longer log in at /oauth/bot. That's what the pull intends.

This pull replaces the owner's DID in KNOTLESS_BOT_DIDS with ci.knotless.dev's and adds review.knotless.dev's. It keeps the triager's DID. It also adds the ci handle to the Terraform handle comments and to the tfvars example. I found nothing wrong with it.

My earlier review asked you to check the two new DIDs against the handles' DID resolution. I can't see whether you did that, because neither DID appears elsewhere in the repository. A wrong DID would only leave that bot with public-only access, which is easy to fix. Dropping the owner's DID means the owner can no longer log in at /oauth/bot, and the pull says that is intended.