REQ 098

REQ-098: Release action credentials only through approval

Requirement

A credential that performs a gated action shall be stored only as a secret of the approval environment for that action class, with one environment per action class, and used only by the executor.

Rationale

Approval then releases the means to act, so the requester holds no standing write credential (decision D3 in VITechnologies/projectbuddy#177). GitHub releases environment secrets only after approval, but jobs on self-hosted runners are not isolated, so GitHub advises treating environment secrets there like repository secrets.

Fit Criterion

An unapproved fixture run cannot read the environment secret. The requester identity has no write permission on the action class's targets. No repository or organization secret available to the gate workflow grants the same capability. Every action class that runs on a self-hosted runner documents the non-isolation caveat.

Verification

Planned, TEST-100; not yet performed live. Offline fixture tests show the no-op executor reads its probe secret only after verification, and the readiness check treats unknown requester access as writable. Secret availability before approval needs a real environment. Live verification waits for Phase 3 of VITechnologies/projectbuddy#179.

Source

Software-Requirements-Specification

Priority

High

TestID

TEST-100

TestArtifact

scripts/tests/test_approval_gate_checks.py executor cases and scripts/tests/test_approval_gate_record.py readiness cases

CodeRef

.github/workflows/approval-gate.yml environment-scoped job permissions, scripts/approval_gate/executors.py, scripts/approval_gate/readiness.py, docs/approval-gate/procedure.md

Status

Planned; offline fixture tests pass, no live proof yet