Repository navigation
Conversation
…ts environment `tailor setup ci env --check` reported TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET set on the repository or the organization with a plain check mark, though any workflow on any branch can read it there and the GitHub Environment's protection rules do not guard it. It now reports it with a warning, also when the environment sets it too, prints the gh commands that set it on the environment and a commented-out command that deletes the repository copy, and ends with a warning instead of the success line. The check still passes. The JSON output carries the scopes as `exposedIn`.
🦋 Changeset detectedLatest commit: 3c97106 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
@tailor-platform/create-sdk
@tailor-platform/eslint-plugin-sdk
@tailor-platform/sdk
@tailor-platform/sdk-plugin-frontend
@tailor-platform/sdk-plugin-seed
@tailor-platform/sdk-plugin-setup
@tailor-platform/sdk-plugin-tailordb-erd
commit: |
Contributor
Code Metrics Report (packages/sdk)Complexity change of this pull request: cognitive +15, cyclomatic +31
Compared with the base commit of this pull request.
Details | | main (0c17d81) | #2922 (16b7e02) | +/- |
|--------------------|----------------|-----------------|------|
| Coverage | 89.2% | 89.2% | 0.0% |
| Files | 578 | 578 | 0 |
| Lines | 25815 | 25815 | 0 |
| Covered | 23035 | 23035 | 0 |
| Code to Test Ratio | 1:0.5 | 1:0.5 | 0.0 |
| Code | 212577 | 212577 | 0 |
| Test | 120407 | 120407 | 0 |SDK Configure Bundle Size
Runtime Performance
Type Performance (instantiations)
Reported by octocov |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
📖 Docs Quality & Consistency Check
✅ Recommended Actions
None — docs are consistent with the implementation and contain no user-facing internal-detail leaks.
⚠️ Consistency Issues
No consistency issues found.
📝 Reader-Perspective Issues
No reader-perspective issues found.
🔍 Details
This PR changes tailor setup ci env --check to warn when TAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRET is set outside its GitHub Environment. The following areas were checked and found consistent:
Command Description (packages/sdk-plugin-setup/src/commands.ts:58)
- ✅ Updated to mention "for a machine user client secret to move onto its environment"
- ✅ Matches the new behavior of printing gh commands to move the secret
Documentation (packages/sdk/docs/github-actions.md)
- ✅ Lines 709-716: Added warning about
--checkflagging repository/organization secrets, consistent with implementation - ✅ Lines 792: Updated "Checking what is registered" section intro to mention moving the client secret
- ✅ Lines 799-809: New bullet explaining the ⚠ warning behavior
- Correctly states the check still passes (no error thrown when
exposedIn.length > 0) - Correctly describes the printed commands (gh secret set + commented-out gh secret delete)
- Correctly notes organization secrets require owner action (no delete command generated)
- Correctly states warning stops when secret is only on environments
- Correctly states the check still passes (no error thrown when
Implementation Verification (packages/sdk-plugin-setup/src/env-check.ts)
- ✅
checkRequirement(lines 45-68): SetsexposedInfor secrets inENVIRONMENT_ONLY_SECRETSfound outside environment - ✅
statusLine(line 330): Shows ⚠ whenexposedIn.length > 0 - ✅
report(lines 247-282): Warns withlogger.warnbut doesn't throw when exposedGroups exist - ✅
renderGhCommandsinenv.ts(lines 288-340): Renders set commands and commented-out delete commands
Changeset (.changeset/major-parts-remain.md)
- ✅ Accurately describes the change from user perspective
- ✅ Mentions
exposedInin JSON output, which matchesRequirementChecktype
Reader Perspective (User-facing documentation only)
- ✅ No internal implementation details leaked (no mention of internal functions, modules, or code structure)
- ✅ All documentation written from SDK user's perspective
- ✅ No JSDoc duplication or private repository references
- ✅ Command description in
commands.tsis user-facing and appropriate
Beta Marks
- ✅ The
setupcommand is properly marked as beta ingithub-actions.md(lines 11-13) - ✅ All commands call
logBetaWarning("setup") - ✅ No changes to beta status in this PR
Re-run this check by adding the
docs-checklabel to the PR.
toiroakr
reviewed
Nov 3, 2026
| howTo: `${MACHINE_USER_HOW_TO}; use its client secret`, | ||
| }; | ||
| /** Secrets that only an environment's protection rules guard, so they belong on the environment. */ | ||
| export const ENVIRONMENT_ONLY_SECRETS: ReadonlySet<string> = new Set([CLIENT_SECRET.name]); |
Contributor
There was a problem hiding this comment.
nit (optional): ENVIRONMENT_ONLY_SECRETS reads as "secrets that can only live on an environment", but the client secret can also sit on the repository or organization; the check only warns there.
Consider a belongsOnEnvironment: true field on CLIENT_SECRET instead, so checkRequirement no longer looks the name up in an exported one-element Set. Renaming to ENVIRONMENT_PREFERRED_SECRETS would also work.
toiroakr
approved these changes
Nov 3, 2026
toiroakr
left a comment
toiroakr
left a comment
Contributor
There was a problem hiding this comment.
LGTM overall. See the inline comment for one optional nit.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
tailor setup ci env --checkreportedTAILOR_PLATFORM_MACHINE_USER_CLIENT_SECRETset on the repository or the organization with ✔, though any workflow on any branch can read it there and the GitHub Environment's protection rules do not guard it. It now warns and prints the commands that move it onto the environment.What changes
ghcommands now also set the client secret on each environment that lacks it, telling you to reuse the value already set, and list a commented-outgh secret deletefor the repository copy. An organization copy gets no command: an organization owner has to stop sharing it with the repository.--jsonreports those scopes per entry asexposedIn.Notes
gh secret deleteis commented out because a deleted secret cannot be restored, and with--environmentan environment the check skipped may still read the repository copy.