Skip to content

fix(ci): remove expiring OAuth token deploy gate #657

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
isuttell merged 1 commit into from
Sep 15, 2026
Merged

fix(ci): remove expiring OAuth token deploy gate #657

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 0 additions & 12 deletions .github/workflows/deploy-production.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,13 +105,6 @@ jobs:
if: ${{ github.event_name == 'workflow_dispatch' }}
run: pnpm verify

- name: Validate authenticated MCP smoke credentials
env:
AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN: ${{ secrets.AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN }}
run: |
set -euo pipefail
test -n "$AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN"

- name: Provision content capability DNS
env:
CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
Expand Down Expand Up @@ -168,11 +161,6 @@ jobs:
- name: Smoke production (read-only, no credentials)
run: pnpm smoke:prod:readonly

- name: Smoke production MCP (authenticated)
env:
AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN: ${{ secrets.AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN }}
run: pnpm smoke:mcp:production

- name: Record Linear release
uses: linear/linear-release-action@c0cb8354a362c24c6d3e0948f37fd66d07588e3f # v0.14.5
with:
Expand Down
8 changes: 5 additions & 3 deletions docs/adr/0097-mcp-private-principal-handoff.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,9 +45,11 @@ delegating the credential or trusting an HTTP header.
- `upload` no longer receives `WORKOS_API_KEY` or MCP issuer/JWKS configuration.
- Scope changes and membership removal still take effect on the next tool call
because downstream Workers resolve the current member row.
- Production deploy smoke must include an authenticated MCP `whoami` and
`list_artifacts` call; a missing user OAuth smoke token fails before deployment.
WorkOS M2M tokens are not valid for this check because their subject is an
- Amended 2026-09-15: production deployment uses credential-free smoke checks.
The original authenticated MCP deploy gate required manual replacement of
short-lived user OAuth tokens and was removed. Authenticated `whoami` and
`list_artifacts` checks remain operator-run with a current session token.
WorkOS M2M tokens are not valid for these checks because their subject is an
application rather than a Workspace Member.
- WorkOS redirect allowlists contain exact callback URIs, never wildcard hosts.
- Each MCP publish/revision body and old/new edit string above 192 Ki characters
Expand Down
10 changes: 6 additions & 4 deletions docs/ops/runbook-mcp-hosts.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -246,10 +246,12 @@ pnpm smoke:mcp:preview
pnpm smoke:mcp:production
```

Production CI reads `AGENT_PASTE_PRODUCTION_MCP_SMOKE_ACCESS_TOKEN`. The token
must belong to a current Workspace Member. WorkOS M2M credentials cannot be used
for this smoke because client-credentials tokens identify an application and
organization, not a user. Replace the CI secret when the user token expires.
Production CI runs `pnpm smoke:prod:readonly`, including MCP metadata, OAuth
challenges, and API-key rejection. Deployment does not require a stored user
OAuth token. Authenticated MCP smoke is an operator check using a current
session token belonging to a Workspace Member. WorkOS M2M credentials cannot
be used for this check because client-credentials tokens identify an
application and organization, not a user.

Obtain the smoke token by completing a normal host OAuth flow against the target
environment, then copy the access token from the host's token store or a
Expand Down
7 changes: 4 additions & 3 deletions docs/ops/status/hosted-ops.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,9 +166,10 @@ pnpm smoke:preview:ephemeral`
8. Production deploy only with explicit Isaac approval:
`pnpm migrate:production && pnpm deploy:production && pnpm smoke:production &&
pnpm smoke:production:ephemeral && pnpm smoke:mcp:production`. The production
GitHub deploy workflow requires a production user OAuth smoke token before
any deploy step, then runs the authenticated MCP smoke after deployment. A
missing token or failed `whoami`/`list_artifacts` call fails the workflow.
GitHub deploy workflow runs `pnpm smoke:prod:readonly` after deployment,
including MCP metadata, OAuth challenges, and API-key rejection. It does not
require a stored user OAuth token. Authenticated MCP checks are operator-run
with a current session token.

## Hosted ephemeral publish smoke

Expand Down