Publish and resolve the deployed scrubber allowlist identity - #3763
Open
cotti wants to merge 1 commit into
Open
Conversation
The scrubber's link allowlist is baked in from config/assembler.yml at build time, so the deployed allowlist was not observable: backfill planning could only validate links against the local checkout, and allowlist skew surfaced only as silent link stripping on publication. The build workflow now computes the embedded allowlist's SHA-256 and build commit, and the release workflow attaches the identity document to the GitHub release only after a successful Lambda deploy — asset presence attests the deploy. A new `changelog scrubber-allowlist` command (and ScrubberAllowlistIdentityService for programmatic consumers) resolves the identity from the newest release carrying the asset, or a specific tag, and compares it against a local assembler.yml. Closes elastic/docs-eng-team#671 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
reakaleek
approved these changes
Aug 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The changelog scrubber's link allowlist is embedded from
config/assembler.ymlat build time, so the allowlist the deployed Lambda actually runs with is not observable today. Backfill planning must validate every attributed repository against the deployed allowlist — otherwise links are silently stripped on publication and surface only as public-gate failures — and the epic's prerequisites call for publishing the deployed identity and pinning it in every plan and ledger.Closes elastic/docs-eng-team#671 (sub-issue of the backfill epic elastic/docs-eng-team#656).
What
Publication (zero IAM changes): the scrubber build workflow computes the embedded allowlist's SHA-256 (
sha256sum config/assembler.ymlat the release tag ref) plus the build commit, and emits achangelog-scrubber-allowlist.jsonidentity document. The release deploy job attaches it to the GitHub release only afteraws lambda update-function-codesucceeded — asset presence on a release attests that the release's allowlist was deployed.Consumption: a new
docs-builder changelog scrubber-allowlistcommand andScrubberAllowlistIdentityServiceresolve the deployed identity from the newest non-draft release carrying the asset (the most recent gated deploy — a release whose deploy never completed is skipped), or from an explicit--tag. When a localassembler.ymlis available the command reports match/skew; skew is a warning, unresolvable identity is a hard failure (exit non-zero), matching the acceptance criterion that a plan cannot be approved without a resolvable identity.The hash format (
sha256:+ 64 hex) and the commit field line up with theScrubberAllowlistcontract introduced in #3681, without depending on it — planning can map the resolved identity straight into plan/ledger pinning.The scrubber's
Program.csis deliberately untouched to avoid conflicting with the registry-ownership stack (#3738–#3761).