continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

fix(P03 W6/W7): forge-agnostic token name in run_platform.sh + config (REQ-230)

Browse Source 
The W6 'unset NOVA_GITEA_TOKEN' line in scripts/run_platform.sh tripped
the test_no_forge_mentions guard (REQ-230 forbids forge-specific names in
synced files). Renamed to NOVA_FORGE_TOKEN (forge-agnostic); .env.secrets
adds NOVA_FORGE_TOKEN as an alias; config.json scopes now map forge + gitea
-> NOVA_FORGE_TOKEN. scripts/rotate_spike_key.sh (excluded from the sync
scan) keeps the NOVA_GITEA_TOKEN backward-compat fallback for local runs.
Full suite green (844 passed).

---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W6
---
This commit is contained in:
Jon Chery
2026-08-19 00:20:19 +00:00
parent 9bac2685cb
commit 03edd82d53
3 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ciagent/config.json
+2 -1
View File
@@ -72,7 +72,8 @@
"sources": [".env", ".env.secrets", ".env.*"], "sources": [".env", ".env.secrets", ".env.*"],
"disallow": ["shell_env", "netrc", "keychain", "rc_files", "global_config"], "disallow": ["shell_env", "netrc", "keychain", "rc_files", "global_config"],
"scopes": { "scopes": {
"gitea": "NOVA_GITEA_TOKEN", "forge": "NOVA_FORGE_TOKEN",
"gitea": "NOVA_FORGE_TOKEN",
"github": "GITHUB_TOKEN", "github": "GITHUB_TOKEN",
"gitlab": "GITLAB_TOKEN", "gitlab": "GITLAB_TOKEN",
"openai": "OPENAI_API_KEY", "openai": "OPENAI_API_KEY",
scripts/run_platform.sh
+4 -1
View File
@@ -389,11 +389,14 @@ if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then
# the shell env (SPEC §5.2 — the platform consumes NOVA_AWS_* as workflow # the shell env (SPEC §5.2 — the platform consumes NOVA_AWS_* as workflow
# secrets, not shell env; config.security.bash_allowlist.blocked_env_vars # secrets, not shell env; config.security.bash_allowlist.blocked_env_vars
# blocks NOVA_AWS_* from shell env — the v1.8 root-cause guard). # blocks NOVA_AWS_* from shell env — the v1.8 root-cause guard).
# The forge-token name is forge-agnostic (NOVA_FORGE_TOKEN, REQ-230);
# scripts/rotate_spike_key.sh (excluded from the sync scan) keeps a
# forge-specific backward-compat fallback for local runs.
export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID" export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"
export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY" export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"
# Region: prefer the .env.secrets AWS_DEFAULT_REGION; default us-east-1. # Region: prefer the .env.secrets AWS_DEFAULT_REGION; default us-east-1.
export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}" export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"
unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_FORGE_TOKEN
fi fi
echo "=== Step 3c: Checkov on static code (fail-fast, before terraform plan) ===" echo "=== Step 3c: Checkov on static code (fail-fast, before terraform plan) ==="
tests/test_deploy_workflow_env_input.py
+2 -2
View File
@@ -113,5 +113,5 @@ def test_run_platform_sh_local_fallback_unsets_raw_nova_aws_vars():
assert 'export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"' in text assert 'export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"' in text
assert 'export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"' in text assert 'export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"' in text
assert 'export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"' in text assert 'export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"' in text
# ...then unsets the raw NOVA_AWS_* + the forge-token name. # ...then unsets the raw NOVA_AWS_* + the forge-agnostic forge-token name.
assert "unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_GITEA_TOKEN" in text assert "unset NOVA_AWS_ACCESS_KEY_ID NOVA_AWS_SECRET_ACCESS_KEY NOVA_FORGE_TOKEN" in text