From d021b3a1d9ffa483a46bab464d14f81b3ff7567b Mon Sep 17 00:00:00 2001 From: Michiel Degezelle Date: Wed, 15 Jul 2026 11:57:00 +0200 Subject: [PATCH 1/2] =?UTF-8?q?TEST:=20strip=20refreshToken=20in=20push=5F?= =?UTF-8?q?to=5Freview=5Ffirm.yml=20(CI=5FAUTH=5FSAMPLER=5FPLAN.md=20?= =?UTF-8?q?=C2=A78=20validation)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/push_to_review_firm.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/push_to_review_firm.yml b/.github/workflows/push_to_review_firm.yml index 4fdf55b..e5d13b6 100644 --- a/.github/workflows/push_to_review_firm.yml +++ b/.github/workflows/push_to_review_firm.yml @@ -163,6 +163,12 @@ jobs: run: | mkdir -p "$HOME/.silverfin" echo '${{ secrets.CONFIG_JSON }}' > "$HOME/.silverfin/config.json" + # Blank every firm's refreshToken so an expired access token fails cleanly on a 401 + # instead of silently rotating (and poisoning) the shared CONFIG_JSON secret this + # workflow never writes back to. See CI_AUTH_SAMPLER_PLAN.md §8. + jq 'to_entries | map(if (.key|test("^[0-9]+$")) then .value.refreshToken = "" else . end) | from_entries' \ + "$HOME/.silverfin/config.json" > "$HOME/.silverfin/config.stripped.json" + mv "$HOME/.silverfin/config.stripped.json" "$HOME/.silverfin/config.json" node ./node_modules/silverfin-cli/bin/cli.js config --set-firm="${FIRM_ID}" node ./node_modules/silverfin-cli/bin/cli.js config --get-firm From 53489f206e27ade35efb9ad5b4c0c6b6935260e2 Mon Sep 17 00:00:00 2001 From: Michiel Degezelle Date: Wed, 15 Jul 2026 13:41:36 +0200 Subject: [PATCH 2/2] Drop stale internal doc reference --- .github/workflows/push_to_review_firm.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/push_to_review_firm.yml b/.github/workflows/push_to_review_firm.yml index e5d13b6..bd643ed 100644 --- a/.github/workflows/push_to_review_firm.yml +++ b/.github/workflows/push_to_review_firm.yml @@ -165,7 +165,7 @@ jobs: echo '${{ secrets.CONFIG_JSON }}' > "$HOME/.silverfin/config.json" # Blank every firm's refreshToken so an expired access token fails cleanly on a 401 # instead of silently rotating (and poisoning) the shared CONFIG_JSON secret this - # workflow never writes back to. See CI_AUTH_SAMPLER_PLAN.md §8. + # workflow never writes back to. jq 'to_entries | map(if (.key|test("^[0-9]+$")) then .value.refreshToken = "" else . end) | from_entries' \ "$HOME/.silverfin/config.json" > "$HOME/.silverfin/config.stripped.json" mv "$HOME/.silverfin/config.stripped.json" "$HOME/.silverfin/config.json"