[CI]: remove RAMPART deploy-key dance now that RAMPART is public - #7
Merged
Nina Chikanov (nina-msft) merged 2 commits intoMay 19, 2026
Merged
Conversation
microsoft/RAMPART is now public, so cloning it during `uv sync` no longer needs the SSH deploy key. - Drop the `Configure SSH for private RAMPART clone` step from both the lint and smoke jobs in `.github/workflows/ci.yml`. - Delete the now-unused `scripts/ci/setup-rampart-ssh.sh` helper. The `RAMPART_REPO_READER` repo secret and the matching deploy key on microsoft/RAMPART still need to be deleted manually (requires admin access this change cannot make). Closes microsoft#3. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Nina Chikanov (nina-msft)
temporarily deployed
to
ci-trusted
May 19, 2026 22:00 — with 
GitHub Actions
Inactive
GitHub Actions
Inactive
Nina Chikanov (nina-msft)
temporarily deployed
to
ci-trusted
May 19, 2026 22:00 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Nina Chikanov (nina-msft)
temporarily deployed
to
ci-trusted
May 19, 2026 22:00 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Nina Chikanov (nina-msft)
temporarily deployed
to
ci-trusted
May 19, 2026 22:00 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Bashir Partovi (bashirpartovi)
approved these changes
May 19, 2026
Bashir Partovi (bashirpartovi)
left a comment
Bashir Partovi (bashirpartovi)
left a comment
Contributor
There was a problem hiding this comment.
LGTM
Spencer Schoenberg (spencrr)
requested changes
May 19, 2026
Spencer Schoenberg (spencrr)
left a comment
Spencer Schoenberg (spencrr)
left a comment
Contributor
There was a problem hiding this comment.
let's also remove ci-trusted environment
This reverts commit d2a6fa6.
Spencer Schoenberg (spencrr)
temporarily deployed
to
ci-trusted
May 19, 2026 22:44 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Spencer Schoenberg (spencrr)
temporarily deployed
to
ci-trusted
May 19, 2026 22:44 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Spencer Schoenberg (spencrr)
temporarily deployed
to
ci-trusted
May 19, 2026 22:44 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Spencer Schoenberg (spencrr)
temporarily deployed
to
ci-trusted
May 19, 2026 22:44 — with
GitHub Actions
Inactive
GitHub Actions
Inactive
Spencer Schoenberg (spencrr)
approved these changes
May 19, 2026
Bashir Partovi (bashirpartovi)
approved these changes
May 19, 2026
Nina Chikanov (nina-msft)
merged commit May 19, 2026
8537be1
into
microsoft:main
5 of 9 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #3.
Summary
microsoft/RAMPART is now public (
visibility: public), so cloning it duringuv syncno longer needs the SSH deploy key. This PR removes the workflow plumbing for that key.Changes
Configure SSH for private RAMPART clonestep from both thelintandsmokejobs in.github/workflows/ci.yml.scripts/ci/setup-rampart-ssh.sh(and the now-emptyscripts/ci/andscripts/directories).CI will now clone
rampartover plain HTTPS, which works because the upstream repo is public.Still TODO (admin action — not done in this PR)
The third bullet in #3 cannot be addressed from a PR:
RAMPART_REPO_READERrepo secret onmicrosoft/rampart-examples.microsoft/RAMPART.These need a repo admin with access to Settings → Secrets and variables → Actions (here) and Settings → Deploy keys (on RAMPART) respectively.
Verification
checkout→setup-uv→uv sync→ checks/tests).grepforRAMPART_REPO_READER,setup-rampart-ssh, andConfigure SSH for privateacross the tree returns no matches.uv syncwas passing only from the uv cache; with RAMPART now public, the unauthenticated HTTPS clone path is exercised on cache-miss runs too.