feat(broker): a pushing forge credential finally has a compliant home (catalogue v1.8.0)

[rubenvdlinde]

Part of hydra's builder-write-access-hardening, task 1 — the credential.

The gap

git push needs a credential, not a proxied API call. git speaks the
smart-HTTP pack protocol, so there is no single request for the broker to make on
the caller's behalf and no header for it to substitute.

The host-locked github entry therefore returns null from
resolveInjectable() by design — and that null is a routing signal
meaning "use request()", not a denial. But request() cannot express a push at
all. So a stage that needs to push has had no compliant credential home: either
the secret sits somewhere it should not, or the push cannot happen.

What this adds

github-push — inject_only, no baseUrl, no allowRules. Exactly the shape
anthropic-cli already uses and for the same stated reason: the broker cannot
bound this call, so it refuses to make it and the guarded resolveInjectable()
path applies instead.

⚠️ A separate entry, not github flipped to inject_only

That would have been the one-line version of this change, and it would have
silently widened every existing github credential in the fleet from "its
secret never leaves OpenRegister" to "its secret is handed to the calling app".

Two entries keeps the pushing credential greppable, reviewable and revocable on
its own. testTheGithubPushCredentialIsInjectOnlyAndTheProxyEntryIsNot() asserts
both halves, so the shortcut cannot be taken later by accident.

What the catalogue cannot enforce, written where it will be read

The $comment is long on purpose — it is the only place whoever mints the token
will look. In short: a fine-grained PAT (or better, a GitHub App installation
token, which expires in an hour) scoped to one repository, Contents: Read and write, and explicitly not Workflows. A credential that can edit
.github/workflows obtains code execution on the forge's runners and escapes
every other control around it. Not a classic PAT — its repo scope is
account-wide and carries workflow write.

It also names the probe that asserts the absence rather than assuming it:
attempt PUT /repos/{owner}/{repo}/contents/.github/workflows/probe.yml and
require the refusal refusing to allow a Personal Access Token to create or update workflow ... without 'workflows' scope. A 201 means revoke, do not store.

The compensating controls live where the credential is used — see
ConductionNL/hermiq#118: the sidecar refuses a push to another repository, to any
branch that is not feature/<issue>/*, or with a diff touching workflows, a
dependency manifest or anything outside the issue's scope; and it withholds the
credential from the process that reads repository content, so none of it depends
on a model's compliance. The forge's branch rulesets are the backstop.

Both tests mutation-checked

mutation	result
rename github-push away	testTheGithubPushCredentialIsInjectOnlyAndTheProxyEntryIsNot fails
re-add a workflow-dispatch allow-rule to github	testNoProviderCanReachAWorkflowDefinition fails, naming the rule

That second grant existed once (#2240) and was reverted (#2242). Nothing until
now would have caught it coming back.

29 tests, 512 assertions, green.

[github-actions]

Quality Report — ConductionNL/openregister @ eba138c

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	❌
psalm	❌
phpstan	❌
phpmetrics	✅
eslint		✅
stylelint		✅
composer			✅	✅ 174/174
npm			✅	✅ 713/713
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

---

Quality workflow — 2026-08-02 15:48 UTC

Download the full PDF report from the workflow artifacts.