Skip to content

security(deploy-pages): replace blanket inherited secrets with an explicit reusable-workflow contract #900

Description

@seonghobae

Buyer/control-plane risk

Protected main currently documents and requires callers of .github/workflows/deploy-pages.yml to use secrets: inherit, while the reusable workflow actually needs only CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID. This creates unnecessary secret exposure at a reusable deployment boundary and contradicts the central explicit-secret contract documented in the active automation architecture line.

RCA

  • Symptom: caller examples and the runtime guard require blanket inherited secrets.
  • Immediate cause: workflow_call declares no explicit secrets interface, so the documentation uses secrets: inherit as the transport.
  • Root cause: the reusable deploy workflow predates the current least-privilege reusable-workflow contract.
  • Current search evidence: organization code search finds no product caller of deploy-pages.yml@... beyond the central workflow and Cloudflare documentation, so an explicit-interface migration is currently bounded to the central repository; this must be rechecked immediately before merge.

Required test-first correction

  1. Add a permanent contract test from protected main that fails while workflow_call.secrets does not explicitly require exactly CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID, or while central examples/guard text require secrets: inherit.
  2. Verify RED on the test-only head before production changes.
  3. Declare the two exact reusable-workflow secrets and reference only those names in the job.
  4. Replace secrets: inherit examples with explicit caller mappings.
  5. Keep workflow-level contents: read, immutable action pins, caller-repository checkout behavior, Cloudflare token purpose, and deployment semantics unchanged.
  6. Re-search the organization for consumers before merge; if any appear, update those thin callers explicitly rather than restoring inheritance.
  7. Run focused test, full central suite, workflow syntax, security/supply-chain gates, git diff --check, and current review.

Acceptance

  • No secrets: inherit remains in the authoritative deploy-pages workflow or its central usage docs.
  • The reusable workflow exposes only the two Cloudflare secret names it consumes.
  • Missing either secret fails closed without printing values.
  • No unrelated secret becomes addressable merely because a caller invokes the deploy workflow.
  • Consumer search/migration evidence and rollback are documented.

Refs the explicit-secret-contract debt in the canonical automation documentation PR.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions