Skip to content

SRE-904: Pass the Renovate token cipher key to housekeeping - #425

Draft
TimDiekmann wants to merge 1 commit into
mainfrom
t/sre-904-harden-the-renovate-workflows-against-untrusted-install-time
Draft

SRE-904: Pass the Renovate token cipher key to housekeeping#425
TimDiekmann wants to merge 1 commit into
mainfrom
t/sre-904-harden-the-renovate-workflows-against-untrusted-install-time

Conversation

@TimDiekmann

Copy link
Copy Markdown
Member

Purpose

hashintel/.github#99 split the centralized Renovate workflow into a mint job and a run job; the installation token crosses the job boundary encrypted with RENOVATE_TOKEN_ENC_KEY. This wires the caller up to that contract, mirroring hashintel/hash#9192.

Related links

What does this change?

  • housekeeping.yml: bump the hashintel/.github pin to b7a5d7f and pass RENOVATE_TOKEN_ENC_KEY through to the reusable workflow (the secret is already set on this repo)
  • Remaining hashintel/.github pins bumped to the same SHA

How to test this?

  • The Housekeeping validate job runs actionlint on the changed workflow (also validated locally with actionlint 1.7.12)
  • After merge, the next scheduled Housekeeping run should mint the token in the split job and run Renovate as before

@TimDiekmann TimDiekmann self-assigned this Aug 10, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant