A snapshot: read at commit 707a04c7ce8 on 2026-10-18T00:06:01Z by majordomus 0.29.0. Nothing on this page is read again. See it live
I0929
Production deploys from CI with a token scoped to one application
Where it stands
devtask.issue- Readiness
- cancelled withdrawn
- Status
- CANCELLED
- Can start
- not now
- Milestone
- Milestone status
- ACTIVE
- Wave
8- Waiting on
- Holds back
- Behind it in all
1- Evidence
0of3
| In the way | Subject | Detail |
|---|---|---|
| issue | I0918 | I0918 is not DONE |
| issue | I0931 | I0931 is not DONE |
Moves
plan.transitionWhat it is
- Objective
- Deploy production from CI on the repository's existing branch policy, using an application-scoped deploy token rather than an account-wide one, with concurrency that stops two pushes racing the same application.
- Why
- An account-wide token in a CI secret is a key to everything the account owns, held by every workflow that can read the secret. A scoped token limits an incident to one application, and concurrency control keeps two deploys from interleaving on one machine.
- Now
- No deployment workflow exists and no token has been created.
- Wanted
- The production workflow deploys through the same core the CLI uses, holds only a scoped token, serialises deployments, and its token is installed without ever appearing in a log or a file.
- Done when
- Cancelled 2026-10-14 on master e28daccd9b: its subject is a token scoped to one Fly application; publishing the image to GHCR already exists without one. The owner disconnected Fly.io on 2026-10-12; this repository deploys release binaries, the GHCR image and GitHub Pages (commit 9af3fa65a4 removed fly.toml).
- Risk
- Cancelling an in-progress deployment can leave a machine half-updated. Whether cancellation is safe is a decision to make explicitly, not a default to inherit.
Acceptance
- The deployment token is scoped to the application, has a deliberate expiry and a descriptive name
- The token is installed as a repository secret without being echoed, printed or written to any file, or the exact one-time command is provided instead when that cannot be done safely
- The workflow deploys through the same deployment core the CLI uses, with no second build implementation
- Concurrency is configured deliberately so two pushes cannot deploy the same application at once, and the choice about cancellation is stated
- External actions are pinned and the provider tool version is deliberate rather than floating
- Validation
bash test/run.sh- Evidence required
deploy_workflowscoped_tokenconcurrency- Evidence present
- unknown: the record carries no `evidence` entries
Scope
- Touches
.github/workflows- Not
An account-wide token in CIA CI-only container build implementation separate from the canonical oneWeakening the token model because a tool was unavailable- Depends on
- Priority
- p1
- Profile
- implementation
- Parallel safe
- true
- Owner
- unknown: the record declares no `owner`
The work so far
- Branches
- none
- Merged
- none
- Commits
0- Trunk
- master
- Sessions
- none
- Created
- 2026-09-06
- Updated
- 2026-10-14
- Started
- unknown: the record declares no `started_at`
- Verified
- unknown: the record declares no `verified_at`
- Completed
- unknown: the record declares no `completed_at`
Synchronisation
- Adapter
scripts/github-sync- Repository
- unknown: the derived plan's header carries no repository
- External issue
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
- State there
- unknown: a live GitHub state; this executable makes no network call, so only `scripts/github-sync --check` can answer it
Findings
Nothing is wrong with these records.