fix: separate CI gateway and PostHog credentials - #1240
Conversation
Keep project API and MCP access separate from gateway access. CI uses the externally issued bearer directly and never mints or remints it.
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Test against a Context Mill branch:
Add Results will be posted here when complete. |
gewenyu99
changed the title
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
gewenyu99
changed the title
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
| # team and 403s. Same secret name wizard-workbench's wizard-ci.yml uses. | ||
| POSTHOG_WIZARD_PROJECT_ID: ${{ secrets.GH_APP_POSTHOG_WIZARD_CI_BOT_TARGET_PROJECT_ID }} | ||
| POSTHOG_WIZARD_REGION: us | ||
| WIZARD_CI_GATEWAY_TOKEN_FILE: ${{ runner.temp }}/gateway-token |
There was a problem hiding this comment.
Low: Gateway bearer exposed to dependency lifecycle scripts
This variable is inherited by smoke-test-ci.sh, which runs pnpm install or npm install for the fixture and installs the wizard package before launching the wizard. A compromised lifecycle script can read the predictable token file and use the bearer; create and expose the file only immediately before the wizard invocation, then remove it after configureGatewayFromCIEnvironment reads it.
PR overviewThis pull request separates CI gateway credentials from PostHog credentials in the smoke-test workflow and configures the gateway credential for the wizard run. One security issue remains: the gateway bearer is exposed while dependency installation scripts execute, allowing a compromised package lifecycle script to read and reuse it. Exploitation depends on a malicious or compromised dependency, and no issues have yet been addressed. Open issues (1)
Fixed/addressed: 0 · PR risk: 3/10 |
|
/wizard-ci basic-integration/javascript-node |
🧙 Wizard CI ResultsTrigger ID:
Configuration
|
3 participants
Problem
CI needs separate gateway and PostHog project credentials.
Changes
Snapshot CI and
--ciuseWIZARD_CI_GATEWAY_TOKEN_FILEdirectly, never minting or reminting. API/MCP credentials stay separate. OptionalWIZARD_CI_GATEWAY_URLdefaults to regional v2.Test plan
132 gateway/Pi/CLI tests and build passed; TypeScript matches main’s 28 existing diagnostics. Full local CI has not passed: direct requests with the trimmed gateway token return 401
auth_failed. CI workflow updates across wizard, wizard-workbench, and context-mill remain pending.