Set up a8c-secrets identities - #25885
Open
mokagio wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Introduces the repository identity scaffolding for the upcoming a8c-secrets migration by adding the repo identity string and the set of Age recipients allowed to encrypt secrets for this repository (no code paths consume these files yet).
Changes:
- Adds
.a8c-secrets/repo-idto define the repository’sa8c-secretsidentity. - Adds
.a8c-secrets/keys.pubwith Age recipients (dev + CI) authorized for this identity.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
.a8c-secrets/repo-id |
Adds the repo identity string used to scope a8c-secrets secrets for this repository. |
.a8c-secrets/keys.pub |
Adds the Age recipient public keys to encrypt secrets for the repo identity. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
mokagio
commented
Aug 10, 2026
| # dev | ||
| age1srcq3hl92ym9jk3ezj5prwhche3w8szc0cssy8t7afrkjmtkxu2qkjsdfn | ||
| # ci | ||
| age1a7xcr6qzwnzgcxq95sq33p58xdzsmful8w7mp2zktvuy5434yuss9rmv8f |
mokagio
added
Tooling
Contributor
|
| App Name | WordPress | |
| Configuration | Release-Alpha | |
| Build Number | 33678 | |
| Version | PR #25885 | |
| Bundle ID | org.wordpress.alpha | |
| Commit | 5fbb0a6 | |
| Installation URL | 3huoe319pbphg |
Contributor
|
| App Name | Jetpack | |
| Configuration | Release-Alpha | |
| Build Number | 33678 | |
| Version | PR #25885 | |
| Bundle ID | com.jetpack.alpha | |
| Commit | 5fbb0a6 | |
| Installation URL | 17t956kjkjopo |
mokagio
enabled auto-merge
August 10, 2026 03:40
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Groundwork extracted from #25772 (AINFRA-1538) so the a8c-secrets migration lands as small, independently reviewable pieces.
Adds the repository's
a8c-secretsidentity: the repo id and the public keys authorised to encrypt for it. Nothing reads these files yet — no encrypted blob is committed, no build phase or CI job consults them — so this is inert until the store swap lands.Testing instructions
Nothing to run. The review is a check that the two values are right:
repo-idmust match the repository this checkout came from.keys.publists the age recipients. Each line can be validated against its private half withage-keygen -y; @AliSoftware already did this for the CI key in Adopt a8c-secrets in WordPress iOS #25772 (comment).