From 043a13f7ca146da33dc8a600d018b2c86f5fe37a Mon Sep 17 00:00:00 2001 From: Steven Kearnes Date: Tue, 4 Aug 2026 20:35:02 -0400 Subject: [PATCH] Stop injecting GitHub OAuth credentials into ord-interface The Flask editor was the only consumer of GH_CLIENT_ID/GH_CLIENT_SECRET, and it is gone from ord-interface as of open-reaction-database/ord-interface#172. The task definition no longer needs them, the execution role no longer needs read access to the secret, and the `github-client` secret itself has no remaining reader. Applied to prod already: the running task exposes only POSTGRES_PASSWORD and ANTHROPIC_API_KEY, and the secret is in its 30-day recovery window. Co-Authored-By: Claude Opus 5 (1M context) --- stacks/interface/__main__.py | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/stacks/interface/__main__.py b/stacks/interface/__main__.py index 73967d8..34c0ce6 100644 --- a/stacks/interface/__main__.py +++ b/stacks/interface/__main__.py @@ -23,13 +23,6 @@ backend = pulumi.StackReference("ord/backend/prod") domain = pulumi.StackReference("ord/domain/prod") -github_client_secret = aws.secretsmanager.Secret( - "github_client_secret", name="github-client" -) -gh_arn = github_client_secret.arn -gh_client_id = gh_arn.apply(lambda arn: f"{arn}:GH_CLIENT_ID::") # ty: ignore[missing-argument, invalid-argument-type] -gh_client_secret = gh_arn.apply(lambda arn: f"{arn}:GH_CLIENT_SECRET::") # ty: ignore[missing-argument, invalid-argument-type] - # Anthropic API key for the natural-language search endpoint, named per-service so other # services can have their own keys. The value is an encrypted Pulumi config secret. config = pulumi.Config() @@ -53,7 +46,6 @@ dockerfile="../../../ord-interface/ord_interface/Dockerfile", secret_arns=[ backend.get_output("rds_password_secret_arn"), - github_client_secret.arn, anthropic_api_key_secret.arn, ], environment=[ @@ -76,14 +68,6 @@ name="POSTGRES_PASSWORD", value_from=backend.get_output("rds_password_secret_arn"), ), - awsx.ecs.TaskDefinitionSecretArgs( - name="GH_CLIENT_ID", - value_from=gh_client_id, - ), - awsx.ecs.TaskDefinitionSecretArgs( - name="GH_CLIENT_SECRET", - value_from=gh_client_secret, - ), awsx.ecs.TaskDefinitionSecretArgs( name="ANTHROPIC_API_KEY", value_from=anthropic_api_key_secret.arn,