SRE-901: Stop handing CI more Vault reach than it uses

[TimDiekmann]

🌟 What is the purpose of this PR?

Three grants in CI that are not used. The hash-side half of SRE-901, which was assumed done in the first pass and never shipped.

🔗 Related links

• SRE-901 (internal)
• SRE-901: Install Renovate from the lockfile .github#93 — the reusable-workflow half, merged

🚫 Blocked by

None.

🔍 What does this change?

• exportToken: true removed from install-sccache and both bench.yml call sites. It has no consumers: VAULT_TOKEN appears nowhere in .github/ except as VAULT_TOKEN: "", clearing it back out
• secrets: inherit removed from the renovate job. The reusable workflow reads no secrets.* — it takes the Vault address from vars.VAULT_ADDR
• contents: write → read. Renovate commits through the API with the App token (RENOVATE_PLATFORM_COMMIT: enabled), so the workflow's own token does not need it

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

⚠️ Known issues

• The five VAULT_TOKEN: "" lines are now redundant. Left in place deliberately; happy to strip them if preferred.
• install-sccache still authenticates with the broad dev role. Narrowing that is Terraform work, tracked in Linear.

🐾 Next steps

• Tracked in Linear.

🛡 What tests cover this?

• actionlint runs in lint.yml and covers the YAML.
• Verified by grep rather than CI: no reference to VAULT_TOKEN, vaultToken or steps.secrets.outputs.vault* anywhere in .github/, which is what makes the exportToken removal safe. Same for secrets.* in the reusable workflow.

❓ How to test this?

1. bench.yml — the Vault step still resolves its three fields and the upload step works
2. Any workflow using install-tools with sccache — the four SCCACHE_* values arrive and the server starts
3. Trigger Housekeeping manually and confirm Renovate still opens and updates PRs

📹 Demo

Not applicable, CI-only change.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 4, 2026 9:24pm
hashdotdesign-tokens	Ready	Preview	Aug 4, 2026 9:24pm
petrinaut	Ready	Preview	Aug 4, 2026 9:24pm

[cursor]

PR Summary

Low Risk
CI-only permission and Vault-action config changes with no application code impact; behavior should stay the same if Vault secret fetch and Renovate App commits still work as today.

Overview
Tightens CI permissions and Vault integration so compromised jobs have less to steal, without changing how sccache, benchmark uploads, or Renovate actually run.

Vault: Drops exportToken: true from install-sccache and both Authenticate Vault steps in bench.yml. Those steps still fetch the same secret paths into env vars; nothing in .github/ consumed the exported VAULT_TOKEN.

Housekeeping / Renovate: The reusable Renovate workflow no longer gets secrets: inherit, and workflow-level contents permission is write → read, since Renovate commits via the App token rather than the workflow’s repo write scope.

^{Reviewed by Cursor Bugbot for commit c5953fd. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Reduces unused CI Vault and repository privileges for SRE-901.

Changes:

• Stops exporting Vault tokens from benchmark and sccache workflows.
• Removes inherited repository secrets from Renovate.
• Downgrades Renovate content access from write to read.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/housekeeping.yml	Restricts Renovate permissions and secret access.
.github/workflows/bench.yml	Prevents two Vault steps from exporting tokens.
.github/actions/install-sccache/action.yml	Prevents sccache setup from exporting its Vault token.

[codspeed-hq]

Merging this PR will not alter performance

✅ 98 untouched benchmarks

---

_{Comparing t/sre-901-harden-the-centralized-renovate-workflow-against-compromised (c5953fd) with main (5aa2a09)}

[github-actions]

Benchmark results

@rust/hash-graph-benches – Integrations

policy_resolution_large

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2002	$$28.8 \mathrm{ms} \pm 169 \mathrm{μs}\left({\color{gray}0.295 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.73 \mathrm{ms} \pm 30.3 \mathrm{μs}\left({\color{gray}4.04 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 1002	$$14.3 \mathrm{ms} \pm 115 \mathrm{μs}\left({\color{gray}0.601 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 3314	$$46.7 \mathrm{ms} \pm 408 \mathrm{μs}\left({\color{gray}3.12 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$16.0 \mathrm{ms} \pm 166 \mathrm{μs}\left({\color{gray}0.587 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 1527	$$26.4 \mathrm{ms} \pm 206 \mathrm{μs}\left({\color{gray}-0.784 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 2078	$$29.9 \mathrm{ms} \pm 223 \mathrm{μs}\left({\color{gray}-0.259 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$4.15 \mathrm{ms} \pm 37.5 \mathrm{μs}\left({\color{gray}-2.068 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 1033	$$15.6 \mathrm{ms} \pm 120 \mathrm{μs}\left({\color{gray}-0.721 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_medium

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 102	$$4.06 \mathrm{ms} \pm 35.2 \mathrm{μs}\left({\color{gray}1.54 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$3.16 \mathrm{ms} \pm 24.8 \mathrm{μs}\left({\color{gray}-1.294 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 52	$$3.53 \mathrm{ms} \pm 22.8 \mathrm{μs}\left({\color{gray}-1.331 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 269	$$5.48 \mathrm{ms} \pm 33.5 \mathrm{μs}\left({\color{gray}-2.145 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.79 \mathrm{ms} \pm 39.6 \mathrm{μs}\left({\color{gray}2.54 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 108	$$4.36 \mathrm{ms} \pm 31.7 \mathrm{μs}\left({\color{gray}0.829 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 133	$$4.69 \mathrm{ms} \pm 27.9 \mathrm{μs}\left({\color{gray}1.75 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.65 \mathrm{ms} \pm 29.2 \mathrm{μs}\left({\color{gray}-0.764 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 63	$$4.35 \mathrm{ms} \pm 31.8 \mathrm{μs}\left({\color{gray}1.74 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_none

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 2	$$2.72 \mathrm{ms} \pm 16.6 \mathrm{μs}\left({\color{gray}-4.626 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.66 \mathrm{ms} \pm 16.8 \mathrm{μs}\left({\color{gray}1.36 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 2	$$2.74 \mathrm{ms} \pm 24.1 \mathrm{μs}\left({\color{gray}-3.393 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 8	$$2.98 \mathrm{ms} \pm 22.6 \mathrm{μs}\left({\color{gray}-4.109 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$2.79 \mathrm{ms} \pm 16.5 \mathrm{μs}\left({\color{gray}-4.742 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 3	$$2.93 \mathrm{ms} \pm 16.3 \mathrm{μs}\left({\color{gray}-4.928 \mathrm{\%}}\right) $$	Flame Graph

policy_resolution_small

Function	Value	Mean	Flame graphs
resolve_policies_for_actor	user: empty, selectivity: high, policies: 52	$$3.32 \mathrm{ms} \pm 29.9 \mathrm{μs}\left({\color{gray}3.76 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: low, policies: 1	$$2.92 \mathrm{ms} \pm 18.3 \mathrm{μs}\left({\color{gray}-2.339 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: empty, selectivity: medium, policies: 26	$$3.18 \mathrm{ms} \pm 22.9 \mathrm{μs}\left({\color{gray}-1.331 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: high, policies: 94	$$3.63 \mathrm{ms} \pm 29.8 \mathrm{μs}\left({\color{gray}-3.939 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: low, policies: 1	$$3.13 \mathrm{ms} \pm 18.1 \mathrm{μs}\left({\color{gray}-4.688 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: seeded, selectivity: medium, policies: 27	$$3.46 \mathrm{ms} \pm 24.0 \mathrm{μs}\left({\color{lightgreen}-5.682 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: high, policies: 66	$$3.67 \mathrm{ms} \pm 28.1 \mathrm{μs}\left({\color{gray}0.292 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: low, policies: 1	$$3.17 \mathrm{ms} \pm 22.3 \mathrm{μs}\left({\color{gray}1.33 \mathrm{\%}}\right) $$	Flame Graph
resolve_policies_for_actor	user: system, selectivity: medium, policies: 29	$$3.64 \mathrm{ms} \pm 26.9 \mathrm{μs}\left({\color{gray}3.30 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_complete

Function	Value	Mean	Flame graphs
entity_by_id;one_depth	1 entities	$$45.9 \mathrm{ms} \pm 244 \mathrm{μs}\left({\color{gray}-3.028 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	10 entities	$$35.6 \mathrm{ms} \pm 213 \mathrm{μs}\left({\color{gray}-4.610 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	25 entities	$$38.9 \mathrm{ms} \pm 206 \mathrm{μs}\left({\color{gray}-1.435 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	5 entities	$$35.4 \mathrm{ms} \pm 262 \mathrm{μs}\left({\color{lightgreen}-33.416 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;one_depth	50 entities	$$46.1 \mathrm{ms} \pm 259 \mathrm{μs}\left({\color{gray}0.494 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	1 entities	$$54.4 \mathrm{ms} \pm 508 \mathrm{μs}\left({\color{gray}-1.207 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	10 entities	$$44.3 \mathrm{ms} \pm 298 \mathrm{μs}\left({\color{gray}-1.222 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	25 entities	$$97.6 \mathrm{ms} \pm 702 \mathrm{μs}\left({\color{red}5.24 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	5 entities	$$37.5 \mathrm{ms} \pm 243 \mathrm{μs}\left({\color{gray}0.209 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;two_depth	50 entities	$$288 \mathrm{ms} \pm 1.19 \mathrm{ms}\left({\color{gray}-1.710 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	1 entities	$$12.0 \mathrm{ms} \pm 76.6 \mathrm{μs}\left({\color{gray}-0.353 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	10 entities	$$12.4 \mathrm{ms} \pm 79.7 \mathrm{μs}\left({\color{gray}0.143 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	25 entities	$$12.3 \mathrm{ms} \pm 93.9 \mathrm{μs}\left({\color{gray}1.89 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	5 entities	$$12.4 \mathrm{ms} \pm 76.8 \mathrm{μs}\left({\color{gray}4.18 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id;zero_depth	50 entities	$$12.4 \mathrm{ms} \pm 87.5 \mathrm{μs}\left({\color{gray}2.06 \mathrm{\%}}\right) $$	Flame Graph

read_scaling_linkless

Function	Value	Mean	Flame graphs
entity_by_id	1 entities	$$12.2 \mathrm{ms} \pm 64.4 \mathrm{μs}\left({\color{gray}0.799 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10 entities	$$12.4 \mathrm{ms} \pm 75.9 \mathrm{μs}\left({\color{gray}1.82 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	100 entities	$$12.3 \mathrm{ms} \pm 76.5 \mathrm{μs}\left({\color{gray}-1.002 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	1000 entities	$$12.9 \mathrm{ms} \pm 79.5 \mathrm{μs}\left({\color{gray}2.81 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	10000 entities	$$12.5 \mathrm{ms} \pm 86.2 \mathrm{μs}\left({\color{gray}-1.516 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity

Function	Value	Mean	Flame graphs
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/block/v/1	$$12.8 \mathrm{ms} \pm 98.9 \mathrm{μs}\left({\color{gray}-2.730 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/book/v/1	$$12.6 \mathrm{ms} \pm 74.3 \mathrm{μs}\left({\color{gray}-3.035 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/building/v/1	$$13.1 \mathrm{ms} \pm 83.2 \mathrm{μs}\left({\color{gray}2.24 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/organization/v/1	$$13.0 \mathrm{ms} \pm 88.3 \mathrm{μs}\left({\color{gray}0.719 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/page/v/2	$$13.0 \mathrm{ms} \pm 85.3 \mathrm{μs}\left({\color{gray}0.698 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/person/v/1	$$12.7 \mathrm{ms} \pm 90.6 \mathrm{μs}\left({\color{gray}-3.798 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/playlist/v/1	$$12.7 \mathrm{ms} \pm 98.6 \mathrm{μs}\left({\color{gray}-2.824 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/song/v/1	$$12.5 \mathrm{ms} \pm 62.7 \mathrm{μs}\left({\color{lightgreen}-5.541 \mathrm{\%}}\right) $$	Flame Graph
entity_by_id	entity type ID: https://blockprotocol.org/@alice/types/entity-type/uk-address/v/1	$$12.5 \mathrm{ms} \pm 78.7 \mathrm{μs}\left({\color{lightgreen}-6.833 \mathrm{\%}}\right) $$	Flame Graph

representative_read_entity_type

Function	Value	Mean	Flame graphs
get_entity_type_by_id	Account ID: bf5a9ef5-dc3b-43cf-a291-6210c0321eba	$$9.60 \mathrm{ms} \pm 65.5 \mathrm{μs}\left({\color{gray}1.63 \mathrm{\%}}\right) $$	Flame Graph

representative_read_multiple_entities

Function	Value	Mean	Flame graphs
entity_by_property	traversal_paths=0	0	$$64.2 \mathrm{ms} \pm 594 \mathrm{μs}\left({\color{lightgreen}-6.289 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$122 \mathrm{ms} \pm 690 \mathrm{μs}\left({\color{gray}-1.061 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$72.0 \mathrm{ms} \pm 503 \mathrm{μs}\left({\color{lightgreen}-7.330 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$83.0 \mathrm{ms} \pm 486 \mathrm{μs}\left({\color{lightgreen}-5.719 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$92.2 \mathrm{ms} \pm 532 \mathrm{μs}\left({\color{lightgreen}-5.778 \mathrm{\%}}\right) $$
entity_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$99.9 \mathrm{ms} \pm 680 \mathrm{μs}\left({\color{gray}-1.099 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=0	0	$$48.5 \mathrm{ms} \pm 293 \mathrm{μs}\left({\color{gray}-0.436 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=255	1,resolve_depths=inherit:1;values:255;properties:255;links:127;link_dests:126;type:true	$$77.8 \mathrm{ms} \pm 582 \mathrm{μs}\left({\color{gray}0.006 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:0;link_dests:0;type:false	$$55.8 \mathrm{ms} \pm 302 \mathrm{μs}\left({\color{gray}3.58 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:0;links:1;link_dests:0;type:true	$$65.4 \mathrm{ms} \pm 467 \mathrm{μs}\left({\color{gray}1.91 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:0;properties:2;links:1;link_dests:0;type:true	$$65.8 \mathrm{ms} \pm 464 \mathrm{μs}\left({\color{gray}-0.583 \mathrm{\%}}\right) $$
link_by_source_by_property	traversal_paths=2	1,resolve_depths=inherit:0;values:2;properties:2;links:1;link_dests:0;type:true	$$67.4 \mathrm{ms} \pm 431 \mathrm{μs}\left({\color{gray}0.644 \mathrm{\%}}\right) $$

scenarios

Function	Value	Mean	Flame graphs
full_test	query-limited	$$128 \mathrm{ms} \pm 744 \mathrm{μs}\left({\color{gray}-0.678 \mathrm{\%}}\right) $$	Flame Graph
full_test	query-unlimited	$$138 \mathrm{ms} \pm 886 \mathrm{μs}\left({\color{gray}-0.455 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-limited	$$21.0 \mathrm{ms} \pm 152 \mathrm{μs}\left({\color{gray}0.905 \mathrm{\%}}\right) $$	Flame Graph
linked_queries	query-unlimited	$$556 \mathrm{ms} \pm 1.43 \mathrm{ms}\left({\color{gray}4.59 \mathrm{\%}}\right) $$	Flame Graph