Skip to content

feat: expose agents-webhook-secret-regenerate (destructive) #10

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mikemolinet merged 1 commit into from
May 9, 2026
+17 −4
Merged

feat: expose agents-webhook-secret-regenerate (destructive) #10

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 15 additions & 2 deletions action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,9 @@ inputs:
executions-report-outcome
Agent identity (Surface 6 messaging primitive, cueapi-cli 0.3.0+):
agents-create, agents-list, agents-get (alias: agents-describe),
agents-update, agents-delete, agents-webhook-secret-get
agents-update, agents-delete, agents-webhook-secret-get,
agents-webhook-secret-regenerate (destructive — rotates the secret;
always passes --yes since CI has no interactive confirm)
Messaging primitive (Surface 6, cueapi-cli 0.3.0+):
messages-send, messages-get, messages-read, messages-ack
Workers (worker registration / cleanup):
Expand Down Expand Up @@ -394,6 +396,17 @@ runs:
cmd=(cueapi agents webhook-secret get)
[ -n "$REF" ] && cmd+=("$REF")
;;
agents-webhook-secret-regenerate)
# Destructive: rotates the agent's webhook signing secret and
# drops the old one immediately. Any in-flight webhook
# deliveries already signed with the old secret will fail
# signature verification on the consumer side. The CLI sends
# the X-Confirm-Destructive: true header automatically;
# we always pass --yes since CI has no interactive confirm.
cmd=(cueapi agents webhook-secret regenerate)
[ -n "$REF" ] && cmd+=("$REF")
cmd+=(--yes)
;;
# Messaging primitive subgroup (Surface 6, cueapi-cli 0.3.0+).
messages-send)
cmd=(cueapi messages send)
Expand Down Expand Up @@ -451,7 +464,7 @@ runs:
[ -n "$SUMMARY" ] && cmd+=(--reason "$SUMMARY")
;;
*)
echo "::error::Unsupported command '$COMMAND'. Supported: create, list, get, update, delete, pause, resume, whoami, usage, fire, executions-list, executions-list-claimable, executions-get, executions-claim, executions-claim-next, executions-heartbeat, executions-report-outcome, agents-create, agents-list, agents-get, agents-describe, agents-update, agents-delete, agents-webhook-secret-get, messages-send, messages-get, messages-read, messages-ack, workers-list, workers-delete, executions-replay, executions-verification-pending, executions-verify."
echo "::error::Unsupported command '$COMMAND'. Supported: create, list, get, update, delete, pause, resume, whoami, usage, fire, executions-list, executions-list-claimable, executions-get, executions-claim, executions-claim-next, executions-heartbeat, executions-report-outcome, agents-create, agents-list, agents-get, agents-describe, agents-update, agents-delete, agents-webhook-secret-get, agents-webhook-secret-regenerate, messages-send, messages-get, messages-read, messages-ack, workers-list, workers-delete, executions-replay, executions-verification-pending, executions-verify."
exit 1
;;
esac
Expand Down
4 changes: 2 additions & 2 deletions parity-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,8 @@
"agents-describe": "Verb alias for agents-get (PR #5, merged 2026-05-07)",
"agents-update": "cueapi agents update <ref> — covers --display-name, --description, --webhook-url, --clear-webhook-url sentinel (PR #5, merged 2026-05-07)",
"agents-delete": "cueapi agents delete <ref> — soft delete (PR #5, merged 2026-05-07)",
"agents-webhook-secret-get":"cueapi agents webhook-secret get <ref> (PR #5, merged 2026-05-07)"
"agents-webhook-secret-get":"cueapi agents webhook-secret get <ref> (PR #5, merged 2026-05-07)",
"agents-webhook-secret-regenerate":"cueapi agents webhook-secret regenerate <ref> --yes — destructive (rotates webhook signing secret + drops old one immediately). The CLI sends X-Confirm-Destructive: true; action passes --yes since CI has no interactive confirm. Ported from Backlog row cmousycjv (Drift-audit deferred 2026-05-07; ported 2026-05-09)."
},

"commands_missing_from_action": {
Expand All @@ -49,7 +50,6 @@
"key regenerate": "POST /v1/auth/key/regenerate — destructive, intentionally gated behind manual flow. NOT-PORTED-INTENTIONAL.",
"key webhook-secret get": "GET /v1/auth/webhook-secret — could be exposed for `outputs:` in CI workflows that need to verify webhook signatures. NEEDS-PORT.",
"key webhook-secret regenerate": "POST /v1/auth/webhook-secret/regenerate — destructive. NOT-PORTED-INTENTIONAL.",
"agents webhook-secret regenerate": "POST /v1/agents/{ref}/webhook-secret/regenerate — destructive; needs --confirm-destructive pattern. Tracked on Backlog (Drift-audit deferred 2026-05-07).",
"agents roster": "GET /v1/agents/roster (cueapi #630) — NEEDS-PORT in cueapi-cli + cueapi-action; cueapi-cli upstream port pending.",
"agents presence": "GET /v1/agents/{ref}/presence (cueapi #662) — NEEDS-PORT in cueapi-cli + cueapi-action; cueapi-cli upstream port pending.",
"agents inbox": "GET /v1/agents/{ref}/inbox — NEEDS-PORT (cueapi-cli has it via #28; Action wrap pending).",
Expand Down