SRE-904: Split token minting from the release run

.github/workflows/deploy.yml

@@ -38,7 +38,7 @@ jobs:
   setup:
     runs-on: ubuntu-24.04
     permissions:
-      id-token: write
+      contents: read
     outputs:
       sourcemaps: ${{ steps.packages.outputs.sourcemaps }}
       backend-images: ${{ steps.packages.outputs.backend-images }}

.github/workflows/housekeeping.yml

@@ -65,11 +65,12 @@ jobs:
       actions: read
       contents: read
       id-token: write
-    uses: hashintel/.github/.github/workflows/housekeeping-dependencies.yml@8c1a3b18a4f6528fc8eabcf9acda7780a1e47776 # main
+    uses: hashintel/.github/.github/workflows/housekeeping-dependencies.yml@b7a5d7f651c1d6a862d5dd97aa6164125bedb6c5 # main
     with:
       repoCache: ${{ inputs.repoCache || 'enabled' }}
       logLevel: ${{ inputs.logLevel || 'info' }}
       overrideSchedule: ${{ inputs.overrideSchedule || false }}
       dryRun: ${{ inputs.dryRun || 'disabled' }}
     secrets:
       CF_ACCESS_STAGE_CLIENT_SECRET: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}
+      RENOVATE_TOKEN_ENC_KEY: ${{ secrets.RENOVATE_TOKEN_ENC_KEY }}

.github/workflows/preflight-todo-comments.yml

@@ -11,4 +11,4 @@ jobs:
     name: Todo comments
     permissions:
       contents: read
-    uses: hashintel/.github/.github/workflows/preflight-todo-comments.yml@8c1a3b18a4f6528fc8eabcf9acda7780a1e47776 # main
+    uses: hashintel/.github/.github/workflows/preflight-todo-comments.yml@b7a5d7f651c1d6a862d5dd97aa6164125bedb6c5 # main

.github/workflows/preflight.yml

@@ -14,7 +14,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write
-    uses: hashintel/.github/.github/workflows/preflight-dependencies.yml@8c1a3b18a4f6528fc8eabcf9acda7780a1e47776 # main
+    uses: hashintel/.github/.github/workflows/preflight-dependencies.yml@b7a5d7f651c1d6a862d5dd97aa6164125bedb6c5 # main
     with:
       # GHSA-frvp-7c67-39w9: advisory has a wrong affected-version range; the fix was
       # backported in @hono/node-server. Remove once github/advisory-database#8824 merges.
@@ -37,4 +37,4 @@ jobs:
     name: PR title
     permissions:
       contents: read
-    uses: hashintel/.github/.github/workflows/preflight-pr-title.yml@8c1a3b18a4f6528fc8eabcf9acda7780a1e47776 # main
+    uses: hashintel/.github/.github/workflows/preflight-pr-title.yml@b7a5d7f651c1d6a862d5dd97aa6164125bedb6c5 # main

.github/workflows/release.yml

@@ -8,17 +8,21 @@
     branches:
       - main
 jobs:
-  release:
+  mint-token:
+    name: Mint token
     runs-on: ubuntu-latest
     if: github.repository == 'hashintel/hash'
     environment: main
     permissions:
+      contents: read
       id-token: write
+    outputs:
+      token-ciphertext: ${{ steps.encrypt.outputs.token-ciphertext }}
 
     steps:
       - name: Get token
         id: app-token
-        uses: hashintel/.github/.github/actions/github-app-token@8c1a3b18a4f6528fc8eabcf9acda7780a1e47776 # main
+        uses: hashintel/.github/.github/actions/github-app-token@b7a5d7f651c1d6a862d5dd97aa6164125bedb6c5 # main
         with:
           vault-address: ${{ vars.VAULT_PROD_ADDR }}
           vault-role: ci-hash-release
@@ -28,6 +32,38 @@
           cf-access-client-id: ${{ vars.CF_ACCESS_PROD_CLIENT_ID }}
           cf-access-client-secret: ${{ secrets.CF_ACCESS_PROD_CLIENT_SECRET }}
 
+      # GitHub drops masked values from job outputs, so only ciphertext can cross.
+      - name: Encrypt token
+        id: encrypt
+        env:
+          TOKEN: ${{ steps.app-token.outputs.token }}
+          ENC_KEY: ${{ secrets.RELEASE_TOKEN_ENC_KEY }}
+        run: |
+          : "${TOKEN:?}" "${ENC_KEY:?}"
+          ciphertext=$(printf '%s' "${TOKEN}" | openssl enc -aes-256-cbc -pbkdf2 -salt -pass env:ENC_KEY -base64 -A)
+          echo "token-ciphertext=${ciphertext}" >>"${GITHUB_OUTPUT}"
+
+  release:
+    runs-on: ubuntu-latest
+    needs: mint-token
+    environment: main
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      # First step, so the plaintext is masked before anything else runs.
+      - name: Decrypt token
+        id: app-token
+        env:
+          TOKEN_CIPHERTEXT: ${{ needs.mint-token.outputs.token-ciphertext }}
+          ENC_KEY: ${{ secrets.RELEASE_TOKEN_ENC_KEY }}
+        run: |
+          : "${TOKEN_CIPHERTEXT:?}" "${ENC_KEY:?}"
+          token=$(printf '%s' "${TOKEN_CIPHERTEXT}" | openssl enc -d -aes-256-cbc -pbkdf2 -pass env:ENC_KEY -base64 -A)
+          echo "::add-mask::${token}"
+          echo "token=${token}" >>"${GITHUB_OUTPUT}"
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -36,9 +72,6 @@
         uses: ./.github/actions/install-tools
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
-          vault_address: ${{ vars.VAULT_STAGE_ADDR }}
-          cf_access_client_id: ${{ vars.CF_ACCESS_STAGE_CLIENT_ID }}
-          cf_access_client_secret: ${{ secrets.CF_ACCESS_STAGE_CLIENT_SECRET }}
 
       - name: Warm up repository
         uses: ./.github/actions/warm-up-repo