Skip to content

feat(s3perm): add the policy vocabulary - #58

Merged
pyropy merged 3 commits into
mainfrom
srdjan/feat/iam-vocabulary
Oct 14, 2026
Merged

feat(s3perm): add the policy vocabulary#58
pyropy merged 3 commits into
mainfrom
srdjan/feat/iam-vocabulary

Conversation

@pyropy

@pyropy pyropy commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Defines which S3 actions a bucket policy may grant, the first layer of the tenant IAM RFC. Bucket lifecycle, bucket policy and ListAllMyBuckets actions stay service-key only.

  • s3perm.PolicyAction, PolicyActions, PolicyWildcard
  • s3:GetBucketPolicy, s3:PutBucketPolicy, s3:DeleteBucketPolicy as service-key permissions
  • Table tests

🤖 Generated with Claude Code

@pyropy
pyropy added this pull request to stack #62 September 10, 2026 16:30
@pyropy
pyropy force-pushed the srdjan/feat/iam-vocabulary branch from b100436 to 4eaeb3f Compare September 11, 2026 10:37
@pyropy
pyropy removed this pull request from stack #62 September 11, 2026 10:38
@pyropy
pyropy force-pushed the srdjan/feat/iam-vocabulary branch from 4eaeb3f to 08de262 Compare September 11, 2026 10:59
@pyropy
pyropy added this pull request to stack #71 September 11, 2026 10:59
@pyropy
pyropy force-pushed the srdjan/feat/iam-vocabulary branch from 08de262 to 6ff0ad9 Compare September 16, 2026 14:11
@pyropy
pyropy requested a lite review from Copilot September 16, 2026 15:10
Copilot AI reviewed Sep 16, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@pyropy

pyropy commented Sep 16, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 16, 2026 •
edited
Loading

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-09-28T16:53:29.506521Z 02ce4b7 Manual request
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector[bot]
chatgpt-codex-connector Bot reviewed Sep 16, 2026
View reviewed changes

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6ff0ad9f87

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread pkg/rpc/service/auth/operation.go Outdated
@pyropy
pyropy force-pushed the srdjan/feat/iam-vocabulary branch from 6ff0ad9 to a8da3c7 Compare September 17, 2026 13:34
@pyropy pyropy changed the title feat(s3perm): add bucket-configuration reads and the policy vocabulary feat(s3perm): add the policy vocabulary Sep 17, 2026
@pyropy
pyropy force-pushed the srdjan/feat/iam-vocabulary branch 3 times, most recently from 2ea4dfa to 2c1d906 Compare September 23, 2026 10:29
@pyropy
pyropy marked this pull request as ready for review September 23, 2026 10:30
@pyropy
pyropy requested a review from a team September 23, 2026 11:14
@pyropy
pyropy force-pushed the srdjan/feat/iam-vocabulary branch 2 times, most recently from 2ea4dfa to ee592d3 Compare September 23, 2026 11:55
@pyropy
pyropy removed this pull request from stack #71 September 24, 2026 11:48
@pyropy
pyropy added this pull request to stack #86 September 24, 2026 11:49
@pyropy

pyropy commented Sep 28, 2026

Copy link
Copy Markdown
Contributor Author

@codex review

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 28, 2026

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. Swish!

Reviewed commit: 02ce4b71f0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@pyropy
pyropy marked this pull request as draft September 28, 2026 17:05
@pyropy
pyropy force-pushed the srdjan/feat/iam-vocabulary branch from 02ce4b7 to df95d65 Compare September 29, 2026 15:22
@pyropy pyropy self-assigned this Sep 30, 2026
@pyropy
pyropy marked this pull request as ready for review September 30, 2026 14:15
@pyropy
pyropy force-pushed the srdjan/feat/iam-vocabulary branch 2 times, most recently from 5016327 to df95d65 Compare September 30, 2026 15:34
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 1, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
5e0c9d8 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 1, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
92bd7a8 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 1, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
7ac1719 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 2, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
138cb41 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 2, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
73d6773 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
alanshaw
alanshaw approved these changes Oct 5, 2026
View reviewed changes
Comment thread pkg/s3perm/s3perm.go Outdated
Comment thread pkg/s3perm/s3perm.go
pyropy and others added 2 commits October 5, 2026 11:14
@pyropy @claude
feat(s3perm): add the policy vocabulary
d85f16d 
PolicyAction reports whether an action may appear in a bucket policy: every
recognized permission except s3:CreateBucket, s3:DeleteBucket and
s3:ListAllMyBuckets.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@pyropy @claude
feat(s3perm): add the bucket policy actions as service-key permissions
7f72cdb 
s3:GetBucketPolicy, s3:PutBucketPolicy and s3:DeleteBucketPolicy are
held by service keys and excluded from bucket policies, as the bucket
lifecycle actions are: a principal holding one could rewrite the policy
that granted it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@pyropy
pyropy force-pushed the srdjan/feat/iam-vocabulary branch from 4e8c978 to 7f72cdb Compare October 5, 2026 09:40
@pyropy @claude
refactor(s3perm): allowlist the policy actions
dc032e8 
PolicyAction and PolicyActions read from a sorted allowlist of the
permissions a bucket policy may carry, in place of subtracting the
bucket-level set from the whole table. A permission added to the table
is not a policy action until it is listed, and an internal test holds
every permission to one side or the other. PolicyActions returns a clone
of the list, so no sort runs per call.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@pyropy
pyropy removed this pull request from stack #86 October 9, 2026 07:33
@pyropy
pyropy added this pull request to stack #95 October 9, 2026 07:33
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 9, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
04761b5 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 12, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
cb45c4b 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 13, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
65c2f5a 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 13, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
0f944ee 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 14, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
4a8d4e1 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 14, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
0857221 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@pyropy
pyropy merged commit 89d4ccf into main Oct 14, 2026
8 checks passed
@pyropy
pyropy deleted the srdjan/feat/iam-vocabulary branch October 14, 2026 11:20
pyropy added a commit to fil-forge/ingot that referenced this pull request Oct 14, 2026
@pyropy @claude
test(itest): ask hilt for the policy permissions only when the IAM sc…
f0a5cfb 
…enarios run

The all-permission test key named s3:GetBucketPolicy, s3:PutBucketPolicy and
s3:DeleteBucketPolicy, which the published hilt image does not know until
fil-forge/hilt#58 merges, so every forge-mode scenario failed at key
creation with 422 InvalidPermission. The three now join the key only under
the same condition that runs the bucket policy scenario: a hilt override, or
INGOT_ITEST_IAM=1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@fil-forge-bot fil-forge-bot Bot mentioned this pull request Oct 14, 2026
Merged
fil-forge-bot Bot added a commit to fil-forge/infra-central that referenced this pull request Oct 14, 2026
@fil-forge-bot
Promote dev's images to staging
f3b487c 
Sets every staging pin in `terraform/envs/staging/apps/terraform.tfvars`
to what `terraform/envs/dev/apps/terraform.tfvars` pins at ccf4093.
Merging this is the promotion: Check and deploy applies `terraform/envs/staging/apps`
on the merge commit, with no further confirmation.

dev passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38577102150.

This pull request is rebuilt each time dev passes its smoke test after a push
to `main`, and closed once staging matches dev. To hold a service back, push
to `bot/promote-staging` by hand: the bot leaves the branch alone while this pull
request is open.

## hilt

`sha256:80076f3` → `sha256:5b6d022`

What fil-forge/hilt brings over staging's pin, `a026d16..42dd070`:

- feat(s3perm): add the policy vocabulary (fil-forge/hilt#58) (89d4ccf)
- feat(store): add the principal store and share-locked reads (fil-forge/hilt#59) (434839e)
- feat(bucketpolicy): add the bucket policy and its evaluation (fil-forge/hilt#60) (b30465e)
- feat(store): add the bucket policy store with compare-and-set writes (fil-forge/hilt#61) (1ff52cb)
- fix(store): bound every Postgres lock wait (fil-forge/hilt#84) (98d7a12)
- feat(api): bind access keys to principals (fil-forge/hilt#64) (894624d)
- feat(grant): rotate and revoke principal-bound key delegations (fil-forge/hilt#65) (e372bcd)
- feat(api): add principals and principal-bound access keys (fil-forge/hilt#66) (880f780)
- feat(api): add bucket policies and the principal access reads (fil-forge/hilt#67) (f366100)
- feat(rpc): authorize principal-bound keys against bucket policies (fil-forge/hilt#68) (9e93a34)
- feat(rpc): answer /s3/bucket/info for a principal-bound key (fil-forge/hilt#85) (b7ed334)
- test(itest): cover the IAM model end to end and document it (fil-forge/hilt#69) (fa1512f)
- feat(api): revoke every key's delegations before removing a tenant (fil-forge/hilt#80) (70f9380)
- feat(rpc): read and write bucket policies over /s3/bucket/policy (fil-forge/hilt#89) (6a675f4)
- feat(bucketpolicy): make the bucket policy an AWS bucket policy document (fil-forge/hilt#96) (42dd070)
fil-forge-bot Bot added a commit to fil-forge/infra-central that referenced this pull request Oct 14, 2026
@fil-forge-bot
Promote dev's images to staging
cf93fe9 
Sets every staging pin in `terraform/envs/staging/apps/terraform.tfvars`
to what `terraform/envs/dev/apps/terraform.tfvars` pins at 8f6b78d.
Merging this is the promotion: Check and deploy applies `terraform/envs/staging/apps`
on the merge commit, with no further confirmation.

dev passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38581685131.

This pull request is rebuilt each time dev passes its smoke test after a push
to `main`, and closed once staging matches dev. To hold a service back, push
to `bot/promote-staging` by hand: the bot leaves the branch alone while this pull
request is open.

## hilt

`sha256:80076f3` → `sha256:5b6d022`

What fil-forge/hilt brings over staging's pin, `a026d16..42dd070`:

- feat(s3perm): add the policy vocabulary (fil-forge/hilt#58) (89d4ccf)
- feat(store): add the principal store and share-locked reads (fil-forge/hilt#59) (434839e)
- feat(bucketpolicy): add the bucket policy and its evaluation (fil-forge/hilt#60) (b30465e)
- feat(store): add the bucket policy store with compare-and-set writes (fil-forge/hilt#61) (1ff52cb)
- fix(store): bound every Postgres lock wait (fil-forge/hilt#84) (98d7a12)
- feat(api): bind access keys to principals (fil-forge/hilt#64) (894624d)
- feat(grant): rotate and revoke principal-bound key delegations (fil-forge/hilt#65) (e372bcd)
- feat(api): add principals and principal-bound access keys (fil-forge/hilt#66) (880f780)
- feat(api): add bucket policies and the principal access reads (fil-forge/hilt#67) (f366100)
- feat(rpc): authorize principal-bound keys against bucket policies (fil-forge/hilt#68) (9e93a34)
- feat(rpc): answer /s3/bucket/info for a principal-bound key (fil-forge/hilt#85) (b7ed334)
- test(itest): cover the IAM model end to end and document it (fil-forge/hilt#69) (fa1512f)
- feat(api): revoke every key's delegations before removing a tenant (fil-forge/hilt#80) (70f9380)
- feat(rpc): read and write bucket policies over /s3/bucket/policy (fil-forge/hilt#89) (6a675f4)
- feat(bucketpolicy): make the bucket policy an AWS bucket policy document (fil-forge/hilt#96) (42dd070)
fil-forge-bot Bot added a commit to fil-forge/infra-central that referenced this pull request Oct 14, 2026
@fil-forge-bot
Promote dev's images to staging
cd45ac1 
Sets every staging pin in `terraform/envs/staging/apps/terraform.tfvars`
to what `terraform/envs/dev/apps/terraform.tfvars` pins at d236fcd.
Merging this is the promotion: Check and deploy applies `terraform/envs/staging/apps`
on the merge commit, with no further confirmation.

dev passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38583928528.

This pull request is rebuilt each time dev passes its smoke test after a push
to `main`, and closed once staging matches dev. To hold a service back, push
to `bot/promote-staging` by hand: the bot leaves the branch alone while this pull
request is open.

## hilt

`sha256:80076f3` → `sha256:5b6d022`

What fil-forge/hilt brings over staging's pin, `a026d16..42dd070`:

- feat(s3perm): add the policy vocabulary (fil-forge/hilt#58) (89d4ccf)
- feat(store): add the principal store and share-locked reads (fil-forge/hilt#59) (434839e)
- feat(bucketpolicy): add the bucket policy and its evaluation (fil-forge/hilt#60) (b30465e)
- feat(store): add the bucket policy store with compare-and-set writes (fil-forge/hilt#61) (1ff52cb)
- fix(store): bound every Postgres lock wait (fil-forge/hilt#84) (98d7a12)
- feat(api): bind access keys to principals (fil-forge/hilt#64) (894624d)
- feat(grant): rotate and revoke principal-bound key delegations (fil-forge/hilt#65) (e372bcd)
- feat(api): add principals and principal-bound access keys (fil-forge/hilt#66) (880f780)
- feat(api): add bucket policies and the principal access reads (fil-forge/hilt#67) (f366100)
- feat(rpc): authorize principal-bound keys against bucket policies (fil-forge/hilt#68) (9e93a34)
- feat(rpc): answer /s3/bucket/info for a principal-bound key (fil-forge/hilt#85) (b7ed334)
- test(itest): cover the IAM model end to end and document it (fil-forge/hilt#69) (fa1512f)
- feat(api): revoke every key's delegations before removing a tenant (fil-forge/hilt#80) (70f9380)
- feat(rpc): read and write bucket policies over /s3/bucket/policy (fil-forge/hilt#89) (6a675f4)
- feat(bucketpolicy): make the bucket policy an AWS bucket policy document (fil-forge/hilt#96) (42dd070)
bajtos pushed a commit to fil-forge/infra-central that referenced this pull request Oct 14, 2026
@fil-forge-bot
Promote dev's images to staging (#232)
a2d3516 
Sets every staging pin in `terraform/envs/staging/apps/terraform.tfvars`
to what `terraform/envs/dev/apps/terraform.tfvars` pins at d236fcd.
Merging this is the promotion: Check and deploy applies `terraform/envs/staging/apps`
on the merge commit, with no further confirmation.

dev passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38583928528.

This pull request is rebuilt each time dev passes its smoke test after a push
to `main`, and closed once staging matches dev. To hold a service back, push
to `bot/promote-staging` by hand: the bot leaves the branch alone while this pull
request is open.

## hilt

`sha256:80076f3` → `sha256:5b6d022`

What fil-forge/hilt brings over staging's pin, `a026d16..42dd070`:

- feat(s3perm): add the policy vocabulary (fil-forge/hilt#58) (89d4ccf)
- feat(store): add the principal store and share-locked reads (fil-forge/hilt#59) (434839e)
- feat(bucketpolicy): add the bucket policy and its evaluation (fil-forge/hilt#60) (b30465e)
- feat(store): add the bucket policy store with compare-and-set writes (fil-forge/hilt#61) (1ff52cb)
- fix(store): bound every Postgres lock wait (fil-forge/hilt#84) (98d7a12)
- feat(api): bind access keys to principals (fil-forge/hilt#64) (894624d)
- feat(grant): rotate and revoke principal-bound key delegations (fil-forge/hilt#65) (e372bcd)
- feat(api): add principals and principal-bound access keys (fil-forge/hilt#66) (880f780)
- feat(api): add bucket policies and the principal access reads (fil-forge/hilt#67) (f366100)
- feat(rpc): authorize principal-bound keys against bucket policies (fil-forge/hilt#68) (9e93a34)
- feat(rpc): answer /s3/bucket/info for a principal-bound key (fil-forge/hilt#85) (b7ed334)
- test(itest): cover the IAM model end to end and document it (fil-forge/hilt#69) (fa1512f)
- feat(api): revoke every key's delegations before removing a tenant (fil-forge/hilt#80) (70f9380)
- feat(rpc): read and write bucket policies over /s3/bucket/policy (fil-forge/hilt#89) (6a675f4)
- feat(bucketpolicy): make the bucket policy an AWS bucket policy document (fil-forge/hilt#96) (42dd070)

Co-authored-by: fil-forge-bot[bot] <318653112+fil-forge-bot[bot]@users.noreply.github.com>
This was referenced Oct 14, 2026
Closed
Merged
fil-forge-bot Bot added a commit to fil-forge/infra-central that referenced this pull request Oct 14, 2026
@fil-forge-bot
Promote staging's images to prod
a12f371 
Sets every prod pin in `terraform/envs/prod/apps/terraform.tfvars`
to what `terraform/envs/staging/apps/terraform.tfvars` pins at 6cdeb78.
Merging this is the promotion: Check and deploy applies `terraform/envs/prod/apps`
on the merge commit, with no further confirmation.

staging passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38589211473.

This pull request is rebuilt each time staging passes its smoke test after a push
to `main`, and closed once prod matches staging. To hold a service back, push
to `bot/promote-prod` by hand: the bot leaves the branch alone while this pull
request is open.

## hilt

`sha256:80076f3` → `sha256:5b6d022`

What fil-forge/hilt brings over prod's pin, `a026d16..42dd070`:

- feat(s3perm): add the policy vocabulary (fil-forge/hilt#58) (89d4ccf)
- feat(store): add the principal store and share-locked reads (fil-forge/hilt#59) (434839e)
- feat(bucketpolicy): add the bucket policy and its evaluation (fil-forge/hilt#60) (b30465e)
- feat(store): add the bucket policy store with compare-and-set writes (fil-forge/hilt#61) (1ff52cb)
- fix(store): bound every Postgres lock wait (fil-forge/hilt#84) (98d7a12)
- feat(api): bind access keys to principals (fil-forge/hilt#64) (894624d)
- feat(grant): rotate and revoke principal-bound key delegations (fil-forge/hilt#65) (e372bcd)
- feat(api): add principals and principal-bound access keys (fil-forge/hilt#66) (880f780)
- feat(api): add bucket policies and the principal access reads (fil-forge/hilt#67) (f366100)
- feat(rpc): authorize principal-bound keys against bucket policies (fil-forge/hilt#68) (9e93a34)
- feat(rpc): answer /s3/bucket/info for a principal-bound key (fil-forge/hilt#85) (b7ed334)
- test(itest): cover the IAM model end to end and document it (fil-forge/hilt#69) (fa1512f)
- feat(api): revoke every key's delegations before removing a tenant (fil-forge/hilt#80) (70f9380)
- feat(rpc): read and write bucket policies over /s3/bucket/policy (fil-forge/hilt#89) (6a675f4)
- feat(bucketpolicy): make the bucket policy an AWS bucket policy document (fil-forge/hilt#96) (42dd070)
bajtos pushed a commit to fil-forge/infra-central that referenced this pull request Oct 14, 2026
@fil-forge-bot
Promote staging's images to prod (#243)
50ef2e4 
Sets every prod pin in `terraform/envs/prod/apps/terraform.tfvars`
to what `terraform/envs/staging/apps/terraform.tfvars` pins at 6cdeb78.
Merging this is the promotion: Check and deploy applies `terraform/envs/prod/apps`
on the merge commit, with no further confirmation.

staging passed its smoke test on that commit in https://github.com/fil-forge/infra-central/actions/runs/38589211473.

This pull request is rebuilt each time staging passes its smoke test after a push
to `main`, and closed once prod matches staging. To hold a service back, push
to `bot/promote-prod` by hand: the bot leaves the branch alone while this pull
request is open.

## hilt

`sha256:80076f3` → `sha256:5b6d022`

What fil-forge/hilt brings over prod's pin, `a026d16..42dd070`:

- feat(s3perm): add the policy vocabulary (fil-forge/hilt#58) (89d4ccf)
- feat(store): add the principal store and share-locked reads (fil-forge/hilt#59) (434839e)
- feat(bucketpolicy): add the bucket policy and its evaluation (fil-forge/hilt#60) (b30465e)
- feat(store): add the bucket policy store with compare-and-set writes (fil-forge/hilt#61) (1ff52cb)
- fix(store): bound every Postgres lock wait (fil-forge/hilt#84) (98d7a12)
- feat(api): bind access keys to principals (fil-forge/hilt#64) (894624d)
- feat(grant): rotate and revoke principal-bound key delegations (fil-forge/hilt#65) (e372bcd)
- feat(api): add principals and principal-bound access keys (fil-forge/hilt#66) (880f780)
- feat(api): add bucket policies and the principal access reads (fil-forge/hilt#67) (f366100)
- feat(rpc): authorize principal-bound keys against bucket policies (fil-forge/hilt#68) (9e93a34)
- feat(rpc): answer /s3/bucket/info for a principal-bound key (fil-forge/hilt#85) (b7ed334)
- test(itest): cover the IAM model end to end and document it (fil-forge/hilt#69) (fa1512f)
- feat(api): revoke every key's delegations before removing a tenant (fil-forge/hilt#80) (70f9380)
- feat(rpc): read and write bucket policies over /s3/bucket/policy (fil-forge/hilt#89) (6a675f4)
- feat(bucketpolicy): make the bucket policy an AWS bucket policy document (fil-forge/hilt#96) (42dd070)

Co-authored-by: fil-forge-bot[bot] <318653112+fil-forge-bot[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@chatgpt-codex-connector chatgpt-codex-connector[bot] chatgpt-codex-connector[bot] left review comments
@alanshaw alanshaw alanshaw approved these changes

Assignees

@pyropy pyropy

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@pyropy @alanshaw