From b5b67226f176a4e831e6eb2ae5a712b0ad82540d Mon Sep 17 00:00:00 2001 From: Bryan Helmkamp Date: Thu, 23 Apr 2026 15:20:58 -0400 Subject: [PATCH] ci: restore install.rs server-symbol allowlist and worker-token scrub exemption Both Boundary checks have been red on main for multiple commits: - check-boundary.sh: install.rs reintroduced direct use of fabro_config::ServerSettings::from_layer in 93b6577cd but was dropped from server_symbol_allowlist in bb0d05be2. Re-add it. - check-env-mutation.sh: the worker FABRO_WORKER_TOKEN scrub added in 077469d0c is documented as the approved pattern in docs-internal/server-secrets-strategy.md but was missing from the allowlist. Add the exact line. Co-Authored-By: Claude Opus 4.7 (1M context) --- bin/dev/check-boundary.sh | 1 + bin/dev/check-env-mutation.sh | 1 + 2 files changed, 2 insertions(+) diff --git a/bin/dev/check-boundary.sh b/bin/dev/check-boundary.sh index 974dc4442..d855e2384 100755 --- a/bin/dev/check-boundary.sh +++ b/bin/dev/check-boundary.sh @@ -5,6 +5,7 @@ cd "$(dirname "$0")/../.." server_symbol_allowlist=( "lib/crates/fabro-cli/src/local_server.rs" + "lib/crates/fabro-cli/src/commands/install.rs" "lib/crates/fabro-cli/src/commands/run/runner.rs" "lib/crates/fabro-cli/src/commands/pr/mod.rs" "lib/crates/fabro-cli/src/commands/pr/create.rs" diff --git a/bin/dev/check-env-mutation.sh b/bin/dev/check-env-mutation.sh index 6b95cb8f7..dff4ac811 100755 --- a/bin/dev/check-env-mutation.sh +++ b/bin/dev/check-env-mutation.sh @@ -21,6 +21,7 @@ while IFS= read -r match; do case "$path:$line" in "lib/crates/fabro-telemetry/src/spawn.rs:std::env::set_var(key, value);" | \ "lib/crates/fabro-telemetry/src/spawn.rs:std::env::remove_var(key);" | \ + 'lib/crates/fabro-cli/src/main.rs:std::env::remove_var("FABRO_WORKER_TOKEN");' | \ 'lib/crates/fabro-server/src/install.rs:std::env::set_var("FABRO_TEST_IN_MEMORY_STORE", "1");') continue ;;