Closed tsaubergine closed 1 month ago
I didn't dig too deeply, but found that the tag protection rules are being deprecated soon. https://github.blog/changelog/2024-05-29-sunset-notice-tag-protections/ Furthermore, the documentation for CODEOWNERS states that the rule sets are superior to the tag protection rules. I understand that the tag protection rules will get migrated, but I feel we should probably use the non-deprecated solution from the start.
I didn't dig too deeply, but found that the tag protection rules are being deprecated soon. https://github.blog/changelog/2024-05-29-sunset-notice-tag-protections/ Furthermore, the documentation for CODEOWNERS states that the rule sets are superior to the tag protection rules. I understand that the tag protection rules will get migrated, but I feel we should probably use the non-deprecated solution from the start.
Oops wrong concept - I was thinking we could protect labels from being deleted. For some reason my brain conflated this with tags, which are obviously different.
Update root yubikeys with software release update
Overview
This PR makes updates to so that the root yubikey authorized_keys (/etc/jaiabot/ssh/root_authorized_keys) can be changed with normal updates to jaiabot now, in the event that the root yubikeys are lost, stolen or need to be replaced for other reasons (e.g., newer version of the keys supporting new features).
Additional PR labeling for verification
To ensure this is done securely (and improve the likelihood that we will catch malicious code inserted to key parts of the repository), this PR adds additional labels (using .github/workflows/pr-labeler.yml) that are automatically attached to pull requests that modify files that are most likely to cause harm. This will be an extra hint to reviewers to pay attention to ensure these changes are correct (and not malicious):
apt update
)I merged the existing PR labeling behavior into this, using the official
labeler@v5
(https://github.com/actions/labeler) action.Further considerations:
Another tool we can use is CODEOWNERS: https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-and-branch-protection