fix(clerk): reject a secret key containing a return character #176884
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: PR housekeeping | |
| # One dispatch per PR event instead of eight. GitHub's run-queue cap | |
| # (500 runs/10s/repo) counts workflow runs, and a run that calls reusable | |
| # workflows counts once, so folding the small always-fire PR workflows | |
| # under this parent divides the burst budget every push consumes. | |
| on: | |
| pull_request: | |
| types: [opened, synchronize, reopened, edited, ready_for_review, review_requested, converted_to_draft] | |
| # Keyed by event action so a new push (synchronize) cancels the previous | |
| # push's run without cancelling runs fired by other event types on the PR. | |
| # A base retarget gets its own key within `edited`: it is the only edit that | |
| # recomputes impacted targets, and a title edit landing behind it would | |
| # otherwise cancel that recompute and leave the stale upload in place. | |
| concurrency: | |
| group: pr-housekeeping-${{ github.event.action }}${{ github.event.changes.base && '-base' || '' }}-${{ github.event.pull_request.number }} | |
| cancel-in-progress: true | |
| # Parent defaults stay read-only; jobs that need more request it explicitly. | |
| permissions: | |
| contents: read | |
| pull-requests: read | |
| jobs: | |
| lint-pr: | |
| # The merge queue opens its own PR per batch, titled after the branch | |
| # (trunk-merge/pr-70624/<uuid>), which can never satisfy Conventional | |
| # Commits. The title that matters was already validated on the PR being | |
| # queued, so checking the queue's copy only fails its run. | |
| if: contains(fromJSON('["opened", "edited", "synchronize"]'), github.event.action) && !startsWith(github.head_ref, 'trunk-merge/') | |
| uses: ./.github/workflows/pr-updated.yml | |
| turbo: | |
| if: contains(fromJSON('["opened", "synchronize", "reopened"]'), github.event.action) | |
| uses: ./.github/workflows/ci-turbo.yml | |
| trunk-impacted-targets: | |
| # Also on ready_for_review: Trunk keys the upload to a head SHA, and a PR | |
| # can sit in draft long enough for the queue to have forgotten it. | |
| # Also on a base retarget, which GitHub does on the PR's behalf when the | |
| # layer below a stack merges. The targets are computed against the merge | |
| # target, so a retarget changes them with no push to recompute them on, | |
| # and the stale upload is what the queue keeps scheduling by. Other | |
| # `edited` actions (title, body) cannot move a target, so they are left out. | |
| if: >- | |
| contains(fromJSON('["opened", "synchronize", "reopened", "ready_for_review"]'), github.event.action) | |
| || (github.event.action == 'edited' && github.event.changes.base != null) | |
| uses: ./.github/workflows/trunk-impacted-targets.yml | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| secrets: | |
| TRUNK_API_TOKEN: ${{ secrets.TRUNK_API_TOKEN }} | |
| rate-limit-monitor: | |
| if: contains(fromJSON('["opened", "synchronize"]'), github.event.action) | |
| uses: ./.github/workflows/monitor-github-rate-limit.yml | |
| secrets: | |
| POSTHOG_DEVEX_PROJECT_API_TOKEN: ${{ secrets.POSTHOG_DEVEX_PROJECT_API_TOKEN }} | |
| GH_APP_POSTHOG_DEVEX_GENERAL_PRIVATE_KEY: ${{ secrets.GH_APP_POSTHOG_DEVEX_GENERAL_PRIVATE_KEY }} | |
| GH_APP_POSTHOG_TESTS_APP_ID: ${{ secrets.GH_APP_POSTHOG_TESTS_APP_ID }} | |
| GH_APP_POSTHOG_TESTS_PRIVATE_KEY: ${{ secrets.GH_APP_POSTHOG_TESTS_PRIVATE_KEY }} | |
| GH_APP_POSTHOG_PATHS_FILTER_PRIVATE_KEY: ${{ secrets.GH_APP_POSTHOG_PATHS_FILTER_PRIVATE_KEY }} | |
| GH_APP_TELEMETRY_PRIVATE_KEY: ${{ secrets.GH_APP_TELEMETRY_PRIVATE_KEY }} | |
| GH_APP_POSTHOG_SETUP_ACTIONS_PRIVATE_KEY: ${{ secrets.GH_APP_POSTHOG_SETUP_ACTIONS_PRIVATE_KEY }} | |
| GH_APP_POSTHOG_PRODUCT_TESTS_PRIVATE_KEY: ${{ secrets.GH_APP_POSTHOG_PRODUCT_TESTS_PRIVATE_KEY }} | |
| flags-project-board: | |
| # No synchronize: board status only transitions on reviewer/draft | |
| # changes, and pushes change neither. Re-asserting the same status on | |
| # every push wasted the run and fought manual card moves. | |
| # No trunk-merge/**: the queue's copy of the PR would add a second, | |
| # throwaway card for work the real PR already tracks. | |
| if: contains(fromJSON('["opened", "reopened", "ready_for_review", "review_requested", "converted_to_draft"]'), github.event.action) && github.event.pull_request.head.repo.full_name == github.repository && !startsWith(github.head_ref, 'trunk-merge/') | |
| uses: PostHog/.github/.github/workflows/flags-project-board.yml@2db3d3b946aeb9e479ce9f0078139a67f8ef38ce | |
| permissions: | |
| contents: read | |
| with: | |
| pr_number: ${{ github.event.pull_request.number }} | |
| pr_node_id: ${{ github.event.pull_request.node_id }} | |
| is_draft: ${{ github.event.pull_request.draft }} | |
| secrets: | |
| PROJECT_BOARD_BOT_APP_ID: ${{ secrets.PROJECT_BOARD_BOT_APP_ID }} | |
| PROJECT_BOARD_BOT_PRIVATE_KEY: ${{ secrets.PROJECT_BOARD_BOT_PRIVATE_KEY }} | |
| pr-opened: | |
| # The queue's PR is authored by the Trunk bot, so assigning it and | |
| # nudging about the git email has nobody to reach. | |
| if: contains(fromJSON('["opened", "ready_for_review"]'), github.event.action) && !startsWith(github.head_ref, 'trunk-merge/') | |
| uses: ./.github/workflows/pr-opened.yml | |
| permissions: | |
| pull-requests: write | |
| secrets: | |
| GH_APP_POSTHOG_ASSIGN_REVIEWERS_APP_ID: ${{ secrets.GH_APP_POSTHOG_ASSIGN_REVIEWERS_APP_ID }} | |
| GH_APP_POSTHOG_ASSIGN_REVIEWERS_PRIVATE_KEY: ${{ secrets.GH_APP_POSTHOG_ASSIGN_REVIEWERS_PRIVATE_KEY }} | |
| comment-density: | |
| # Also on a base retarget: the measured diff is base-relative, so a | |
| # retarget changes it with no push to remeasure on. | |
| if: >- | |
| contains(fromJSON('["opened", "synchronize", "reopened"]'), github.event.action) | |
| || (github.event.action == 'edited' && github.event.changes.base != null) | |
| uses: ./.github/workflows/pr-comment-density.yml | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| resolve-bot-comments: | |
| if: github.event.action == 'synchronize' | |
| uses: ./.github/workflows/pr-resolve-outdated-bot-comments.yml | |
| secrets: | |
| GH_APP_POSTHOG_REVIEW_COMMENT_RESOLVER_APP_ID: ${{ secrets.GH_APP_POSTHOG_REVIEW_COMMENT_RESOLVER_APP_ID }} | |
| GH_APP_POSTHOG_REVIEW_COMMENT_RESOLVER_PRIVATE_KEY: ${{ secrets.GH_APP_POSTHOG_REVIEW_COMMENT_RESOLVER_PRIVATE_KEY }} | |
| migrations-separation: | |
| # Same reason the desktop coupling check skips trunk-merge/**: the queue's | |
| # batch PR is the union of several PRs that each passed separately, so a | |
| # migration PR batched with a nodejs or rust PR trips a coupling nobody wrote. | |
| # Same-repo scoping too, so a fork can't skip the check by branch name. | |
| if: | | |
| contains(fromJSON('["opened", "synchronize", "reopened"]'), github.event.action) && !( | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| startsWith(github.head_ref, 'trunk-merge/') | |
| ) | |
| uses: ./.github/workflows/ci-migrations-service-separation-check.yml | |
| secrets: | |
| GH_APP_POSTHOG_PATHS_FILTER_PRIVATE_KEY: ${{ secrets.GH_APP_POSTHOG_PATHS_FILTER_PRIVATE_KEY }} | |
| release-plan: | |
| if: contains(fromJSON('["opened", "synchronize", "reopened"]'), github.event.action) | |
| uses: ./.github/workflows/release.yml | |
| secrets: | |
| POSTHOG_API_TOKEN: ${{ secrets.POSTHOG_API_TOKEN }} |