Jannik/PaperClipAI
1
0 Fork 0
mirror of https://github.com/paperclipai/paperclip.git synced 2026-10-24 01:41:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci(hermes): supply the selected Google qualification key

Browse Source 
Map GEMINI_API_KEY only for the selected paid matrix credential. Extend the trusted-workflow credential checks to prevent ambient Google secrets in unapproved workflows. This fixes the reviewed Google cells startup failure.

Validation: all 15 workflow security tests, actionlint, and diff checks pass.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
DottaandPaperclip committed 2026-10-08 12:28:11 -05:00
1 parent 4313a55dde
commit 6f75f7a59c
3 files changed
+9 -1
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

.github/workflows/runner-full-stack-e2e.yml
+1
View File
@@ -1079,6 +1079,7 @@ jobs:
ANTHROPIC_API_KEY: ${{ matrix.credentialName == 'ANTHROPIC_API_KEY' && secrets.ANTHROPIC_API_KEY || '' }}
OPENROUTER_API_KEY: ${{ matrix.credentialName == 'OPENROUTER_API_KEY' && secrets.OPENROUTER_API_KEY || '' }}
XAI_API_KEY: ${{ matrix.credentialName == 'XAI_API_KEY' && secrets.XAI_API_KEY || '' }}
GEMINI_API_KEY: ${{ matrix.credentialName == 'GEMINI_API_KEY' && secrets.GEMINI_API_KEY || '' }}
GROK_AUTH_JSON: ${{ matrix.credentialName == 'GROK_AUTH_JSON' && secrets.GROK_AUTH_JSON || '' }}
DAYTONA_API_KEY: ${{ matrix.environmentId == 'daytona' && secrets.DAYTONA_API_KEY || '' }}
PAPERCLIP_E2E_DAYTONA_IMAGE: ${{ needs.daytona_image.outputs.image }}
doc/plans/2026-10-06-hermes-native-runner.md
+6
View File
@@ -590,3 +590,9 @@ passed. The five verified encrypted cloud proofs are preserved; the disposable
EC2 instance was terminated and its unused role, instance profile and security
group removed. No local Docker was used. These fixture refinements require
fresh current-head CI and review; they do not complete release qualification.
Fresh review found that the paid workflow did not supply the new Google cells'
required Gemini key. The key is now mapped only when the selected matrix cell
requires it, and the workflow credential-boundary regression covers it. All 15
workflow tests and actionlint pass. Another current-head review and CI run are
required after this correction.
tests/runner-e2e/workflow-security.test.ts
+2 -1
View File
@@ -609,6 +609,7 @@ describe("public repository paid workflow security", () => {
ANTHROPIC_API_KEY: "matrix.credentialName == 'ANTHROPIC_API_KEY'",
OPENROUTER_API_KEY: "matrix.credentialName == 'OPENROUTER_API_KEY'",
XAI_API_KEY: "matrix.credentialName == 'XAI_API_KEY'",
GEMINI_API_KEY: "matrix.credentialName == 'GEMINI_API_KEY'",
GROK_AUTH_JSON: "matrix.credentialName == 'GROK_AUTH_JSON'",
DAYTONA_API_KEY: "matrix.environmentId == 'daytona'",
})) {
@@ -637,7 +638,7 @@ describe("public repository paid workflow security", () => {
);
const providerSecretReferences = [
...contents.matchAll(
/secrets(?:\.(?:OPENAI_API_KEY|ANTHROPIC_API_KEY|OPENROUTER_API_KEY|XAI_API_KEY|GROK_AUTH_JSON|DAYTONA_API_KEY)\b|\[['"](?:OPENAI_API_KEY|ANTHROPIC_API_KEY|OPENROUTER_API_KEY|XAI_API_KEY|GROK_AUTH_JSON|DAYTONA_API_KEY)['"]\])/g,
/secrets(?:\.(?:OPENAI_API_KEY|ANTHROPIC_API_KEY|OPENROUTER_API_KEY|XAI_API_KEY|GEMINI_API_KEY|GROK_AUTH_JSON|DAYTONA_API_KEY)\b|\[['"](?:OPENAI_API_KEY|ANTHROPIC_API_KEY|OPENROUTER_API_KEY|XAI_API_KEY|GEMINI_API_KEY|GROK_AUTH_JSON|DAYTONA_API_KEY)['"]\])/g,
),
];
if (providerSecretReferences.length > 0) {