Automation Secrets¶
Required secrets¶
| Secret | Scope | Purpose |
|---|---|---|
ACTIONS_BOT_SIGNING_KEY |
GitHub Actions | SSH private key used for signed automation commits |
GITHUB_TOKEN |
GitHub Actions | GitHub API access for PRs, attestations, and scans |
Required local variables¶
| Variable | Scope | Purpose |
|---|---|---|
HOMEBREW_INSTALLER_SHA256 |
macOS bootstrap | Verifies the Homebrew installer before execution |
CHEZMOI_INSTALLER_SHA256 |
Installer | Verifies the Chezmoi installer before execution |
Provisioning notes¶
- Store the SSH signing private key in GitHub Actions as
ACTIONS_BOT_SIGNING_KEY. - Store the matching public key in allowed_signers.
- Rotate the key on personnel or workstation change.
- Fail closed when secrets are absent.