Install the breakglass caller

[ulziibay-kernel]

Nineteen lines, no logic — the whole per-repo install for breakglass.

Comment /breakglass <reason> on a PR here and it merges without its required approval, recording the reason on the PR. The mechanism lives in kernel/security-workflows and is shared, so changes to it need no PR here.

This repo is public, which is why the mechanism is hosted in a public repo — a public repository cannot call a reusable workflow stored in a private one, and the failure is silent (run created, zero jobs, nothing on the PR).

Why a file per repo: issue_comment fires in the repo where the comment is left, and GitHub only runs a workflow if the file is on that repo's default branch. Reusable workflows share logic, not triggers.

Docs: kernel/infra docs/breakglass.md

Depends on kernel/security-workflows#18 landing first. Requires the org-level BREAKGLASS_APP_ID / BREAKGLASS_APP_PRIVATE_KEY secrets shared with this repo, and the kernel-breakglass app installed on it.

---

Note

Medium Risk
Introduces an approval-bypass merge path gated by comment and shared app credentials; misconfiguration or compromised breakglass secrets could allow unauthorized merges.

Overview
Adds a minimal GitHub Actions workflow so reviewers can comment /breakglass <reason> on a PR to merge it without required approvals, with the reason recorded on the PR.

The new .github/workflows/breakglass.yml only wires the trigger: it runs on issue_comment when the body starts with /breakglass, uses no job permissions, and delegates to the shared kernel/security-workflowsbreakglass-merge.yml reusable workflow. It passes only BREAKGLASS_APP_ID and BREAKGLASS_APP_PRIVATE_KEY (not secrets: inherit) so the external workflow does not receive every repo secret.

Depends on the shared breakglass workflow in kernel/security-workflows and org/repo secrets plus the kernel-breakglass GitHub App on this repository.

^{Reviewed by Cursor Bugbot for commit e2ab697. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sjmiller609]

reviewed the shared breakglass caller rollout — looks good.