From e2ab6973a61235b48769103193add7ae51e8add1 Mon Sep 17 00:00:00 2001
From: ulziibay-kernel <253135130+ulziibay-kernel@users.noreply.github.com>
Date: Mon, 24 Aug 2026 19:13:23 +0000
Subject: [PATCH] Install the breakglass caller

Nineteen lines, no logic. The mechanism is kernel/security-workflows
.github/workflows/breakglass-merge.yml; this only routes a /breakglass comment to
it, so changes to the mechanism need no PR here.

Hosted in a public repo because this one is public, and a public repository
cannot call a reusable workflow stored in a private one.

See kernel/infra docs/breakglass.md.
---
 .github/workflows/breakglass.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)
 create mode 100644 .github/workflows/breakglass.yml

diff --git a/.github/workflows/breakglass.yml b/.github/workflows/breakglass.yml
new file mode 100644
index 00000000..1569809e
--- /dev/null
+++ b/.github/workflows/breakglass.yml
@@ -0,0 +1,21 @@
+name: Breakglass
+
+# Comment `/breakglass <reason>` on a PR to merge it without its required approval.
+# The mechanism lives in kernel/security-workflows; this file is the whole per-repo install
+# and should never grow logic. See kernel/infra docs/breakglass.md.
+
+on:
+  issue_comment:
+    types: [created]
+
+permissions: {}
+
+jobs:
+  merge:
+    if: github.event.issue.pull_request && startsWith(github.event.comment.body, '/breakglass')
+    uses: kernel/security-workflows/.github/workflows/breakglass-merge.yml@main
+    # Named rather than `secrets: inherit`: this calls a workflow in another repository, and
+    # inherit would hand it every secret this repo holds.
+    secrets:
+      BREAKGLASS_APP_ID: ${{ secrets.BREAKGLASS_APP_ID }}
+      BREAKGLASS_APP_PRIVATE_KEY: ${{ secrets.BREAKGLASS_APP_PRIVATE_KEY }}