refactor: Fetch registry SSH keys on executor worker by daryllimyt · Pull Request #2550 · TracecatHQ/tracecat

daryllimyt · 2026-04-21T18:52:31Z

Summary

Stop serializing registry SSH private keys into RegistrySyncRequest Temporal payloads.
Fetch the org-scoped registry SSH key on the ExecutorWorker immediately before git clone.
Forbid unexpected fields on the Temporal sync request and add regression coverage that rejects ssh_key in request payloads.

Why

Sandboxed registry sync runs the git clone inside the executor worker, but the previous implementation resolved the private key in the API service and carried it through the workflow/activity request. This change keeps Temporal workflow and activity payloads limited to non-secret lookup context, so the key only exists in the worker process at clone time.

Validation

uv run ruff check tracecat/registry/sync/schemas.py tracecat/registry/sync/base_service.py tracecat/registry/sync/runner.py tests/unit/test_registry_sync_runner.py
uv run ruff format --check tracecat/registry/sync/schemas.py tracecat/registry/sync/base_service.py tracecat/registry/sync/runner.py tests/unit/test_registry_sync_runner.py
uv run basedpyright tracecat/registry/sync/schemas.py tracecat/registry/sync/base_service.py tracecat/registry/sync/runner.py tests/unit/test_registry_sync_runner.py
Commit hooks passed, including Ruff, secret scan, and Python type check.

Focused pytest was not completed after the worktree move because the repo test session fixtures require local services; the earlier run was interrupted before completion.

Summary by cubic

Fetch org-scoped registry SSH keys on the executor worker right before git clone, and ignore any legacy ssh_key in Temporal payloads. Adds role-scoped secret access and clearer preflight failures to reduce secret exposure and improve reliability.

Refactors
- Remove ssh_key from RegistrySyncRequest; accept legacy payloads with extra="ignore".
- Worker fetches the org SSH key via SecretsService using organization_id; API only preflights that the secret exists before scheduling.
- Runner resolves the key with _fetch_registry_ssh_key(...), passes it to _clone_repository(...), and forwards organization_id to discovery.
Bug Fixes
- Bind a role-scoped service session when fetching the SSH key on the worker.
- Preflight now preserves unexpected secret lookup errors; missing key raises a clear error naming the required org secret.

^{Written for commit 8161188. Summary will update on new commits.}

zeropath-ai · 2026-04-21T18:54:49Z

✅ No security or compliance issues detected. Reviewed everything up to 8161188.

Security Overview

🔎 Scanned files: 5 changed file(s)
🔗 Scan Link: https://zeropath.com/app/repositories/00dffd6c-8834-4dc9-b6d8-b44cd1622986?scanId=dbae0cb1-d552-4a28-925b-883543dbf69a&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► tests/unit/test_registry_sync_base_service.py Add tests for git SSH key validation Add tests for unexpected secret check errors ► tests/unit/test_registry_sync_runner.py Add test for ignoring legacy SSH keys in request Add test for passing resolved commit SHA Add test for fetching SSH key using role-scoped session ► tracecat/registry/sync/base_service.py Validate existence of registry git SSH key before scheduling workflow Remove SSH key from RegistrySyncRequest payload ► tracecat/registry/sync/runner.py Fetch registry SSH key on the ExecutorWorker ► tracecat/registry/sync/schemas.py Remove ssh_key from RegistrySyncRequest

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c819c06a27

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

No issues found across 4 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 047e33b45a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 047e33b45a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

cubic-dev-ai

1 issue found across 4 files (changes from recent commits).

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="tracecat/registry/sync/base_service.py">

<violation number="1" location="tracecat/registry/sync/base_service.py:602">
P1: Do not catch all exceptions for the preflight secret check; it masks non-not-found failures as "missing secret".</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

daryllimyt temporarily deployed to internal-registry-ci April 21, 2026 18:52 — with GitHub Actions Inactive

This comment has been minimized.

Sign in to view

daryllimyt marked this pull request as ready for review April 21, 2026 19:05

Fetch registry SSH keys on worker

70c09ba

daryllimyt force-pushed the codex/registry-sync-worker-ssh-key branch from c819c06 to 70c09ba Compare April 21, 2026 19:09

daryllimyt temporarily deployed to internal-registry-ci April 21, 2026 19:09 — with GitHub Actions Inactive

daryllimyt changed the title ~~[codex] Fetch registry SSH keys on executor worker~~ refactor: Fetch registry SSH keys on executor worker Apr 21, 2026

chatgpt-codex-connector Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread tracecat/registry/sync/base_service.py

Comment thread tracecat/registry/sync/schemas.py Outdated

cubic-dev-ai Bot reviewed Apr 21, 2026

View reviewed changes

daryllimyt added 2 commits April 21, 2026 15:25

fix: preflight registry ssh key existence

0d60d47

fix: accept legacy registry sync payloads

047e33b

daryllimyt temporarily deployed to internal-registry-ci April 21, 2026 19:27 — with GitHub Actions Inactive

daryllimyt temporarily deployed to internal-registry-ci April 21, 2026 19:28 — with GitHub Actions Inactive

chatgpt-codex-connector Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread tracecat/registry/sync/runner.py Outdated

chatgpt-codex-connector Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread tracecat/registry/sync/runner.py Outdated

cubic-dev-ai Bot reviewed Apr 21, 2026

View reviewed changes

Comment thread tracecat/registry/sync/base_service.py Outdated

daryllimyt added 2 commits April 21, 2026 15:46

fix: bind registry ssh key session role

ed37317

fix: preserve registry secret preflight errors

8161188

daryllimyt temporarily deployed to internal-registry-ci April 21, 2026 19:47 — with GitHub Actions Inactive

daryllimyt temporarily deployed to internal-registry-ci April 21, 2026 19:48 — with GitHub Actions Inactive

daryllimyt merged commit f64a16d into main Apr 21, 2026
17 checks passed

daryllimyt deleted the codex/registry-sync-worker-ssh-key branch April 21, 2026 20:01

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

refactor: Fetch registry SSH keys on executor worker#2550

refactor: Fetch registry SSH keys on executor worker#2550
daryllimyt merged 5 commits intomainfrom
codex/registry-sync-worker-ssh-key

daryllimyt commented Apr 21, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

zeropath-ai Bot commented Apr 21, 2026 •

edited

Loading

Uh oh!

This comment has been minimized.

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

daryllimyt commented Apr 21, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Validation

Summary by cubic

Uh oh!

zeropath-ai Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment has been minimized.

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

daryllimyt commented Apr 21, 2026 •

edited by cubic-dev-ai Bot

Loading

zeropath-ai Bot commented Apr 21, 2026 •

edited

Loading