Repository navigation
feat(pat): CI mode — PEM from APP_PRIVATE_KEY env - #8
Merged
Merged
Conversation
pat now works in environments without Bitwarden (e.g. GitHub Actions): when APP_PRIVATE_KEY is set, it's used directly as the PEM and Bitwarden is skipped entirely. Priority: APP_PRIVATE_KEY env > Bitwarden. - pat_with_pem: env branch (no pat_bw_ensure_unlocked / no bw field read). - pat_require_deps: bw is only required when APP_PRIVATE_KEY is unset, so CI runners without bw installed still work. - cmd_install: prints "CI mode: APP_PRIVATE_KEY set (Bitwarden skipped)" and skips the bw-item checks. - tests: new CI-mode test signs a JWT from an env PEM with bw unfindable. Same pat binary now works locally (Bitwarden) and in CI (env secret). Co-Authored-By: Claude <[email protected]>
axisrow
added a commit
that referenced
this pull request
Jul 20, 2026
… worktree Updates codex-fork to sha c25698b (1.0.6-fork.4). Changes since fork.3: - rescue default --background + terminal-on-timeout (#8) - worktree isolation with leave-branch cleanup (#12, based on openai#137) - 4 security fixes: symlink guard (#18), symlink neutralize (#20), git-dir eliminate (#22), accumulation warn (#23) - test-teardown: npm test no longer leaks broker processes (#5) Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
axisrow
added a commit
that referenced
this pull request
Jul 20, 2026
… worktree Updates codex-fork to sha c25698b (1.0.6-fork.4). Changes since fork.3: - rescue default --background + terminal-on-timeout (#8) - worktree isolation with leave-branch cleanup (#12, based on openai#137) - 4 security fixes: symlink guard (#18), symlink neutralize (#20), git-dir eliminate (#22), accumulation warn (#23) - test-teardown: npm test no longer leaks broker processes (#5) Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
patnow works without Bitwarden — in CI (GitHub Actions) where bw isn't installed, the App private key is supplied via theAPP_PRIVATE_KEYenv secret and used directly. Samepatbinary works locally (Bitwarden) and in CI (env).Priority:
APP_PRIVATE_KEYenv > Bitwarden.Why
The profile-sync automation (axisrow/profile → cross-push to axisrow/axisrow + axisrow.github.io) needs
patinside a GitHub Actions workflow. CI runners don't have Bitwarden; the PEM comes from a repository secret. This unblocks the auto-sync pipeline without a long-lived PAT.Changes
pat_with_pem: env branch — skipspat_bw_ensure_unlockedand the bw field read whenAPP_PRIVATE_KEYis set.pat_require_deps:bwis only required whenAPP_PRIVATE_KEYis unset (CI runners without bw work).cmd_install: prints "CI mode" and skips bw-item checks.tests/run_tests.sh: new test signs a JWT from an env PEM with bw unfindable.Verified
APP_PRIVATE_KEY=<pem> pat install→ "CI mode: APP_PRIVATE_KEY set (Bitwarden skipped)", App reachable, token minted (ghs_…, 40 chars).🤖 Generated with Claude Code