From 623ff66fe41c8b44329a65982f819247d382a07a Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Mon, 29 Jun 2026 15:52:42 -0400 Subject: [PATCH] chore(secrets): drop OPENAI/GOOGLE/GROQ key shells (revoked, providers removed) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Those three providers were dropped in the Bedrock/Fireworks migration and their keys revoked; the live Secrets Manager objects (open-swe-{dev,prod}/{OPENAI,GOOGLE,GROQ}_API_KEY) were deleted (7-day recovery). Remove them from the IaC so a future cdk deploy does not recreate the shells, and from fetch-config's mirror array so boot stops requesting them: - config-store.ts SECRET_VARS + descriptions (28 -> 25 shells) - fetch-config.sh SECRET_VARS array (kept in lockstep) - put-config.sh: drop the put_secret lines; ANTHROPIC_API_KEY re-labelled optional (eval judge only — Bedrock builder/reviewer auth via the host IAM role). REQUIRED_PROVIDER_KEYS is not set in SSM, so it uses the FIREWORKS_API_KEY default. --- deploy/seahaven/fetch-config.sh | 4 ++-- deploy/seahaven/put-config.sh | 5 +---- infra/lib/constructs/config-store.ts | 11 ++++------- 3 files changed, 7 insertions(+), 13 deletions(-) diff --git a/deploy/seahaven/fetch-config.sh b/deploy/seahaven/fetch-config.sh index 50e8b214..77457768 100755 --- a/deploy/seahaven/fetch-config.sh +++ b/deploy/seahaven/fetch-config.sh @@ -182,9 +182,9 @@ SECRET_VARS=( ANTHROPIC_API_KEY CORRIDOR_API_TOKEN CORRIDOR_MCP_TOKEN CORRIDOR_TOKEN DASHBOARD_JWT_SECRET DAYTONA_API_KEY EXA_API_KEY FIREWORKS_API_KEY GITHUB_APP_CLIENT_SECRET GITHUB_APP_PRIVATE_KEY GITHUB_PAT GITHUB_WEBHOOK_SECRET - GOOGLE_API_KEY GROQ_API_KEY JUDGE_ANTHROPIC_API_KEY LANGSMITH_API_KEY + JUDGE_ANTHROPIC_API_KEY LANGSMITH_API_KEY LANGSMITH_API_KEY_PROD LANGCHAIN_API_KEY LINEAR_API_KEY LINEAR_WEBHOOK_SECRET - OPENAI_API_KEY RUNLOOP_API_KEY SLACK_BOT_TOKEN SLACK_CLIENT_SECRET + RUNLOOP_API_KEY SLACK_BOT_TOKEN SLACK_CLIENT_SECRET SLACK_SIGNING_SECRET TOKEN_ENCRYPTION_KEY USER_ID_API_KEY_MAP X_SERVICE_AUTH_JWT_SECRET ) diff --git a/deploy/seahaven/put-config.sh b/deploy/seahaven/put-config.sh index f75194d2..dddb9609 100755 --- a/deploy/seahaven/put-config.sh +++ b/deploy/seahaven/put-config.sh @@ -88,8 +88,7 @@ put_param() { # TOKEN_ENCRYPTION_KEY, GITHUB_APP_PRIVATE_KEY/CLIENT_SECRET, the active provider # key(s) (ANTHROPIC_API_KEY + OPENAI_API_KEY by default), LANGSMITH_API_KEY_PROD, # and (prod) GITHUB_WEBHOOK_SECRET + SLACK_SIGNING_SECRET. -put_secret ANTHROPIC_API_KEY # REQUIRED — primary builder provider key -put_secret OPENAI_API_KEY # REQUIRED — default reviewer provider key +put_secret ANTHROPIC_API_KEY # optional — eval judge only (JUDGE_ANTHROPIC_API_KEY fallback); Bedrock builder/reviewer use the host IAM role put_secret DASHBOARD_JWT_SECRET # REQUIRED — dashboard session JWT signing put_secret TOKEN_ENCRYPTION_KEY # REQUIRED — Fernet key(s) for GH-token crypto put_secret GITHUB_APP_PRIVATE_KEY # REQUIRED — GitHub App PEM (multiline; quote it) @@ -106,8 +105,6 @@ put_secret DAYTONA_API_KEY # only if SANDBOX_TYPE=daytona put_secret EXA_API_KEY # optional — Exa web search put_secret FIREWORKS_API_KEY # active non-Claude key (fallback/subagents); Bedrock uses the host IAM role put_secret GITHUB_PAT # optional — PAT fallback -put_secret GOOGLE_API_KEY # only if a google_genai: model is used -put_secret GROQ_API_KEY # only if a groq: model is used put_secret JUDGE_ANTHROPIC_API_KEY # optional — eval judge (falls back to ANTHROPIC) put_secret LANGSMITH_API_KEY # optional — LangSmith (dev) put_secret LANGCHAIN_API_KEY # optional — LangSmith alt name diff --git a/infra/lib/constructs/config-store.ts b/infra/lib/constructs/config-store.ts index 4cae862c..099749ae 100644 --- a/infra/lib/constructs/config-store.ts +++ b/infra/lib/constructs/config-store.ts @@ -56,15 +56,12 @@ export const SECRET_VARS: readonly string[] = [ "GITHUB_APP_PRIVATE_KEY", "GITHUB_PAT", "GITHUB_WEBHOOK_SECRET", - "GOOGLE_API_KEY", - "GROQ_API_KEY", "JUDGE_ANTHROPIC_API_KEY", "LANGSMITH_API_KEY", "LANGSMITH_API_KEY_PROD", "LANGCHAIN_API_KEY", "LINEAR_API_KEY", "LINEAR_WEBHOOK_SECRET", - "OPENAI_API_KEY", "RUNLOOP_API_KEY", "SLACK_BOT_TOKEN", "SLACK_CLIENT_SECRET", @@ -73,7 +70,10 @@ export const SECRET_VARS: readonly string[] = [ "USER_ID_API_KEY_MAP", "X_SERVICE_AUTH_JWT_SECRET", ] as const; -// 28 secret shells. The T9 inventory header said "29" vs 27 enumerated; reconciled +// 25 secret shells (OPENAI_API_KEY / GOOGLE_API_KEY / GROQ_API_KEY removed in the +// Bedrock/Fireworks migration — those providers are dropped from SUPPORTED_MODELS and +// their keys revoked + secret objects deleted). The T9 inventory header said "29" vs +// 27 enumerated; reconciled // (Adam confirm 2026-06-26): USER_ID_API_KEY_MAP (maps user ids -> API keys; flagged // sensitive by the T5 security review) is a SECRET and is included here. // JUDGE_ANTHROPIC_BASE_URL is a URL (non-sensitive config, eval-only) -> SSM/default, @@ -93,15 +93,12 @@ const SECRET_DESCRIPTIONS: Record = { GITHUB_APP_PRIVATE_KEY: "GitHub App private key PEM (installation-token minting).", GITHUB_PAT: "GitHub PAT fallback (optional).", GITHUB_WEBHOOK_SECRET: "GitHub webhook signature secret (prod-required).", - GOOGLE_API_KEY: "Google GenAI key (only if a google_genai: model is used).", - GROQ_API_KEY: "Groq LLM key (only if a groq: model is used).", JUDGE_ANTHROPIC_API_KEY: "Eval judge key (optional; falls back to ANTHROPIC_API_KEY).", LANGSMITH_API_KEY: "LangSmith key (dev).", LANGSMITH_API_KEY_PROD: "LangSmith key (prod / deployed sandbox).", LANGCHAIN_API_KEY: "LangSmith key alt name (fallback).", LINEAR_API_KEY: "Linear API key (optional).", LINEAR_WEBHOOK_SECRET: "Linear webhook signature secret (required when Linear is wired).", - OPENAI_API_KEY: "OpenAI key (primary reviewer provider).", RUNLOOP_API_KEY: "Runloop sandbox key (only if SANDBOX_TYPE=runloop).", SLACK_BOT_TOKEN: "Slack bot token (optional).", SLACK_CLIENT_SECRET: "Slack OAuth client secret.",