feat(actions): distribute chart updater app key to OpenTofu roots - #45
Merged
Conversation
Contributor
OpenTofu CI passedValidation output (redacted, last 12000 characters) |
This was referenced Aug 30, 2026
The www access-key lookups drifted to www_access_key_id / www_secret_access_key, which do not exist in secrets/secrets.yaml; the values are stored as www_aws_access_key_id / www_aws_secret_access_key (matching the onion_* naming). This broke every plan on main with "Invalid index" since the drift landed.
No value migration is needed: the www AWS values still exist in secrets/secrets.yaml under the www_aws_* key names; only the main.tf lookups had drifted.
Summary
chart_updater_github_app_private_keyrecipient list to the five OpenTofu caller roots:tfroot-aws,tfroot-cloudflare,tfroot-gcp,tfroot-github,tfroot-libvirtwww_access_key_id/www_secret_access_keylookups drifted from the actual SOPS key names (www_aws_access_key_id/www_aws_secret_access_key, matching theonion_aws_*naming), which failed every plan onmainwithInvalid indexand blocked the post-feat: manage private agent knowledge repository #44 apply. The values never leftsecrets/secrets.yaml; only themain.tfreferences were wrong. No SOPS or secret-value changes.name =) changes, so existing Actions secrets are untouchedContext
This finishes the migration started in #42. The shared OpenTofu workflow's generated-docs commit path (makeitworkcloud/shared-workflows#33) now consumes
CHART_UPDATER_GITHUB_APP_PRIVATE_KEYas an Actions secret, matching howchartsalready uses it, so each caller repository needs the secret provisioned. The chart updater GitHub App installation already covers the organization.Per
docs/chart-updater-github-app.md, adding source repositories broadens private-key distribution and requires explicit review. Once this and the companion PRs merge and apply, the AWS Secrets Manager copy becomes genuinely unreferenced; removing thegithub-actions-opentofu-docsrole is tracked in makeitworkcloud/tfroot-aws#32 (draft).Validation
github_actions_secret.secretsinstances plus the already-pendinggithub_branch_protection.relaxed_protections["agent-knowledge"]from feat: manage private agent knowledge repository #44, and modifies nothing else.Rollout
Merge and let the environment-gated apply complete before merging the five caller PRs, so the Actions secret exists when callers start mapping it. Merge order: shared-workflows#33 first, then this PR, then the caller PRs.