docs(ci): caller must pass the jury secret explicitly — inherit does not cross orgs - #4
Open
todie wants to merge 1 commit into
Open
docs(ci): caller must pass the jury secret explicitly — inherit does not cross orgs#4todie wants to merge 1 commit into
todie wants to merge 1 commit into
Conversation
secrets: inherit does not cross organizations. This workflow lives in cerebral-work, so an unsigned-gg caller using inherit gets an EMPTY AGENT_JURY_API_KEY and a 401 whose body reads 'No api key passed in' — which reads like a bad key rather than a missing one, and cost a round of misdiagnosis today. Proven with the same caller in four repos: both cerebral-work callers received the key and delivered verdicts; both unsigned-gg callers got nothing. The documented snippet was the source of the bad pattern, so it is corrected here as well as in the six callers already converted.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
secrets: inheritdoes not cross organization boundaries. This workflow lives incerebral-work, so anunsigned-ggcaller usinginheritreceives an empty secret and the gateway returns401 "Authentication Error, No api key passed in".That body reads like a bad key rather than a missing one, which is what made it worth a comment block rather than a one-liner.
Proven with the identical caller across four repos today:
Repo secrets were seeded 21s before those runs, so staleness is ruled out — the only variable is the org.
Doc-only; no behaviour change, so
@v1remains valid. All six converted callers already use the explicit form.