Uh oh!
There was an error while loading. Please reload this page.
docs(code-quality): reverse the #142 secrets:inherit note — Q5 decided the other way (backend#1526) - #147
Merged
Merged
Conversation
…d the other way (backend#1526) Callers pass NO secrets line (RFC-BACKEND-1405 Q5): the no-op was conditional on this file staying secretless, and @main floating means a future secrets reference reaches every inheriting caller's full secret set at once. Explicit per-secret passing if ever needed; the Bugbot nag dies in per-repo BUGBOT.md rules, and the INVERSE (a caller adding inherit) is what now deserves a finding. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Comment-only change to the reusable's header, reversing what #142 documented. RFC-BACKEND-1405 Q5 was answered 2026-08-04 (rfcs#11, merged): secretless callees get no
secrets:line.secrets: inheritline removed.@mainfloating means a future${{ secrets.X }}step reaches every inheriting caller's entire secret set at once (toJSON(secrets)). If a secret is ever genuinely needed: explicit per-secret passing, neverinherit..cursor/BUGBOT.md(the #1304 flywheel, PRs landing in parallel under backend#1526) — and the rule inverts the check: a caller addinginheritis what deserves a finding.Part of tracebloc/backend#1526. The four caller-line removals (tracebloc-website, model-zoo, start-training, docs) land as sibling PRs.
🤖 Generated with Claude Code
Note
Low Risk
Comment-only change to adoption docs; no CI logic, permissions, or secret handling is modified.
Overview
Documentation-only update to the reusable
code-quality.ymlheader, reversing the adoption guidance from PR #142.The ADOPTION snippet no longer shows
# secrets: inherit; callers should omitsecrets:entirely for this secretless workflow. The explanatory note now records RFC-BACKEND-1405 Q5:inheritwas only a conditional no-op, and with callers pinned at@main, a future${{ secrets.X }}step would expose every inheriting repo’s full secret set. If secrets are ever needed, callers must pass them explicitly, never viainherit. Bugbot’s “missing secrets” nag is documented as handled per-repo in.cursor/BUGBOT.md, with the inverted rule that addingsecrets: inheritis what should be flagged.No workflow runtime behavior changes in this PR; sibling PRs remove the line from individual callers.
Reviewed by Cursor Bugbot for commit a9f1156. Bugbot is set up for automated code reviews on this repo. Configure here.