Makepad-fr · kaanyagci · Sep 5, 2026 · Sep 5, 2026 · Sep 5, 2026 · Sep 5, 2026
diff --git a/README.md b/README.md
@@ -226,37 +226,43 @@ GitHub environment variables. The exact Brio inventory is:
 
 | Canonical Proton Pass item | Protected GitHub environment | Exact mirrored fields |
 | --- | --- | --- |
-| `Hetzner Database Server makepad` | `canary`, `production`, `staging-brio-identity-db`, and `keycloak-cohort-restore` | canonical SSH fields `DEPLOY_SSH_HOST`, `DEPLOY_SSH_PORT`, `DEPLOY_SSH_USER`, `DEPLOY_SSH_PRIVATE_KEY`, `DEPLOY_SSH_KNOWN_HOSTS`; mirror the same reviewed values under the workflow aliases `BRIO_IDENTITY_DB_DEPLOY_SSH_HOST`, `BRIO_IDENTITY_DB_DEPLOY_SSH_PORT`, `BRIO_IDENTITY_DB_DEPLOY_SSH_USER`, `BRIO_IDENTITY_DB_DEPLOY_SSH_PRIVATE_KEY`, `BRIO_IDENTITY_DB_DEPLOY_SSH_KNOWN_HOSTS`, `KEYCLOAK_COHORT_DB_SSH_HOST`, `KEYCLOAK_COHORT_DB_SSH_PORT`, `KEYCLOAK_COHORT_DB_SSH_USER`, `KEYCLOAK_COHORT_DB_SSH_PRIVATE_KEY`, and `KEYCLOAK_COHORT_DB_SSH_KNOWN_HOSTS` only in their named environments |
+| `Hetzner App Server makepad` | `canary` and `production` | native fields `host`, `port`, `user`, `private_key`, and `known_hosts` map to the existing shared `DEPLOY_SSH_*` destinations |
+| `Hetzner Database Server makepad` | `staging-brio-identity-db` and `keycloak-cohort-restore` | canonical fields `DEPLOY_SSH_HOST`, `DEPLOY_SSH_PORT`, `DEPLOY_SSH_USER`, `DEPLOY_SSH_PRIVATE_KEY`, and `DEPLOY_SSH_KNOWN_HOSTS` map only to the `BRIO_IDENTITY_DB_DEPLOY_SSH_*` and `KEYCLOAK_COHORT_DB_SSH_*` aliases in their named environments |
 | `Brio Staging - PostgreSQL` | `canary` and `staging-brio-identity-db` | secrets `POSTGRES_CANARY_SUPERUSER_PASSWORD`, `BRIO_STAGING_DB_PASSWORD`, `BRIO_STAGING_BACKUP_DB_PASSWORD`, `KEYCLOAK_BRIO_STAGING_DB_PASSWORD`, and `KEYCLOAK_BRIO_STAGING_BACKUP_DB_PASSWORD` |
 | `Brio Staging - PKI and Backup Keys` | `canary` and `staging-brio-identity-db` | secrets `POSTGRES_CA_PEM`, `POSTGRES_SERVER_CERT_PEM`, `POSTGRES_SERVER_KEY_PEM`, and public recipient certificate `BRIO_BACKUP_RECIPIENT_CERT_PEM` |
 | `PostgreSQL · Brio identity release orchestrator` | `release-brio-identity-db` | secret `KEYCLOAK_RELEASE_ORCHESTRATOR_TOKEN` |
 | `PostgreSQL · Keycloak cohort source reader` | `keycloak-cohort-restore` | secret `KEYCLOAK_COHORT_SOURCE_TOKEN` |
 | `Makepad Docker Hardened Images` | `keycloak-cohort-restore` | canonical fields `DOCKERHUB_USERNAME` and `DOCKERHUB_PRO_PAT`, mirrored as secrets `DHI_REGISTRY_USERNAME` and `DHI_REGISTRY_PASSWORD` |
 
-The `canary`, `production`, `staging-brio-identity-db`, and
-`keycloak-cohort-restore` environments also hold reviewed non-secret constants
-such as `DEPLOY_REMOTE_DIR`, stack/network names,
-`BRIO_IDENTITY_DB_HOSTNAME`, and `BRIO_KEYCLOAK_DB_SOURCE_CIDR`. Store them as
-environment variables, not duplicated password-vault secrets.
+The shared workflows retain their existing GitHub classification for remote
+directory and stack/network destinations. Only the two public standalone-host
+inputs `BRIO_IDENTITY_DB_HOSTNAME` and `BRIO_KEYCLOAK_DB_SOURCE_CIDR` are
+environment variables; the other reviewed destinations are environment
+secrets because their workflows consume `secrets.*`.
 
-Use `pass-cli` from an approved administrator workstation and stream secret
-values over standard input:
+Audit the reviewed policy and destination names without materializing fields:
 
 ```bash
-pass-cli item view --item-title '<item>' --field '<field>' \
-  | gh secret set '<NAME>' --env '<environment>' --repo 'Makepad-fr/postgres'
+./scripts/sync-github-environments.sh --check
 ```
 
-Never place values in command arguments, temporary files, shell history,
-Actions logs, or issue text. Mirror non-secret variables with the same reviewed
-reconciliation session, compare their GitHub read-back, and record only item
-IDs, field names, timestamps, and non-secret fingerprints in the deployment
-change record. Every listed environment, including `production`, must have
+After reviewing that result and receiving action-time approval, sync exactly
+one environment with the matching confirmation string:
+
+```bash
+./scripts/sync-github-environments.sh --sync \
+  --environment staging-brio-identity-db \
+  --confirm Makepad-fr/postgres:staging-brio-identity-db
+```
+
+The helper streams values over standard input and never changes repository or
+environment policy. Every listed environment, including `production`, has
 exactly one custom branch deployment policy whose type is `branch` and whose
 name is exactly `main`; GitHub's generic "protected branches" option is not an
 equivalent restriction. A release is blocked if an item or field is missing,
-if that exact policy or required reviewers are absent, or if GitHub differs
-from the reviewed Proton version.
+if the pinned policy identity or required reviewers drift, or if GitHub differs
+from the reviewed Proton version. See `docs/credential-sync.md` for the exact
+read/write boundary and adversarial validation.
 
 Audit all five policies without changing provider state:
 

diff --git a/deploy/credential-inventory.json b/deploy/credential-inventory.json
@@ -0,0 +1,128 @@
+{
+  "schemaVersion": 3,
+  "repository": "Makepad-fr/postgres",
+  "vault": "Makepad",
+  "repositoryPolicy": {
+    "repositoryId": 1200300784,
+    "private": false,
+    "visibility": "public",
+    "allowForking": true,
+    "defaultBranch": "main",
+    "requiredChecks": ["policy-and-integration"],
+    "requiredCheckAppId": 15368,
+    "mainProtection": {
+      "strictStatusChecks": true,
+      "enforceAdmins": true,
+      "dismissStaleReviews": true,
+      "requireCodeOwnerReviews": true,
+      "requiredApprovingReviewCount": 1,
+      "requireLastPushApproval": true,
+      "requiredSignatures": true,
+      "requiredLinearHistory": true,
+      "requiredConversationResolution": true,
+      "allowForcePushes": false,
+      "allowDeletions": false,
+      "blockCreations": false,
+      "lockBranch": false,
+      "allowForkSyncing": false
+    },
+    "actionsPolicy": {
+      "defaultWorkflowPermissions": "read",
+      "canApprovePullRequestReviews": false
+    },
+    "environments": {
+      "canary": {"id": 21262761188, "branchPolicyId": 59128365, "reviewerId": null, "reviewerLogin": null},
+      "production": {"id": 15050761884, "branchPolicyId": 59156955, "reviewerId": null, "reviewerLogin": null},
+      "staging-brio-identity-db": {"id": 21278291993, "branchPolicyId": 59143916, "reviewerId": 39597780, "reviewerLogin": "idilsaglam"},
+      "release-brio-identity-db": {"id": 21284627193, "branchPolicyId": 59149936, "reviewerId": 39597780, "reviewerLogin": "idilsaglam"},
+      "keycloak-cohort-restore": {"id": 21284627918, "branchPolicyId": 59149937, "reviewerId": 39597780, "reviewerLogin": "idilsaglam"}
+    }
+  },
+  "operatorEntries": [],
+  "preservedDestinations": {
+    "canary": {
+      "secret": [
+        "KEYCLOAK_BRIO_STAGING_BACKUP_DB_PASSWORD",
+        "KEYCLOAK_BRIO_STAGING_DB_PASSWORD"
+      ],
+      "variable": []
+    },
+    "production": {
+      "secret": [
+        "DEPLOY_FASHION_DB_NAME",
+        "DEPLOY_FASHION_DB_NETWORK",
+        "DEPLOY_FASHION_DB_PASSWORD",
+        "DEPLOY_FASHION_DB_USER",
+        "DEPLOY_SCRAPING_DB_NAME",
+        "DEPLOY_SCRAPING_DB_NETWORK",
+        "DEPLOY_SCRAPING_DB_PASSWORD",
+        "DEPLOY_SCRAPING_DB_USER"
+      ],
+      "variable": []
+    },
+    "staging-brio-identity-db": {
+      "secret": [
+        "BRIO_STAGING_BACKUP_DB_PASSWORD",
+        "BRIO_STAGING_DB_PASSWORD"
+      ],
+      "variable": ["POSTGRES_HOST_COMPOSE_PROJECT"]
+    },
+    "release-brio-identity-db": {"secret": [], "variable": []},
+    "keycloak-cohort-restore": {"secret": [], "variable": []}
+  },
+  "entries": [
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"DEPLOY_SSH_HOST","item":"Hetzner App Server makepad","field":"host"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"DEPLOY_SSH_PORT","item":"Hetzner App Server makepad","field":"port"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"DEPLOY_SSH_USER","item":"Hetzner App Server makepad","field":"user"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"DEPLOY_SSH_PRIVATE_KEY","item":"Hetzner App Server makepad","field":"private_key"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"DEPLOY_SSH_KNOWN_HOSTS","item":"Hetzner App Server makepad","field":"known_hosts"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"DEPLOY_REMOTE_DIR","item":"PostgreSQL · shared Swarm deployment","field":"DEPLOY_REMOTE_DIR"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"DEPLOY_STACK_NAME","item":"PostgreSQL · shared Swarm deployment","field":"DEPLOY_STACK_NAME"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"DEPLOY_CATWLK_DB_NETWORK","item":"PostgreSQL · shared Swarm deployment","field":"DEPLOY_CATWLK_DB_NETWORK"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"DEPLOY_LE_PETIT_COIN_DB_NETWORK","item":"Le Petit Coin GitHub Deploy Secrets","field":"DEPLOY_DB_NETWORK"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"DEPLOY_BRIO_STAGING_DB_NETWORK","item":"Brio Staging - PostgreSQL","field":"DEPLOY_BRIO_STAGING_DB_NETWORK"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"POSTGRES_CANARY_SUPERUSER_PASSWORD","item":"Brio Staging - PostgreSQL","field":"POSTGRES_CANARY_SUPERUSER_PASSWORD"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"BRIO_STAGING_DB_PASSWORD","item":"Brio Staging - PostgreSQL","field":"BRIO_STAGING_DB_PASSWORD"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"BRIO_STAGING_BACKUP_DB_PASSWORD","item":"Brio Staging - PostgreSQL","field":"BRIO_STAGING_BACKUP_DB_PASSWORD"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"POSTGRES_CA_PEM","item":"Brio Staging - PKI and Backup Keys","field":"POSTGRES_CA_PEM"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"POSTGRES_SERVER_CERT_PEM","item":"Brio Staging - PKI and Backup Keys","field":"POSTGRES_SERVER_CERT_PEM"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"POSTGRES_SERVER_KEY_PEM","item":"Brio Staging - PKI and Backup Keys","field":"POSTGRES_SERVER_KEY_PEM"},
+    {"environment":"canary","kind":"secret","requirement":"required","destination":"BRIO_BACKUP_RECIPIENT_CERT_PEM","item":"Brio Staging - PKI and Backup Keys","field":"BRIO_BACKUP_RECIPIENT_CERT_PEM"},
+
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_SSH_HOST","item":"Hetzner App Server makepad","field":"host"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_SSH_PORT","item":"Hetzner App Server makepad","field":"port"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_SSH_USER","item":"Hetzner App Server makepad","field":"user"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_SSH_PRIVATE_KEY","item":"Hetzner App Server makepad","field":"private_key"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_SSH_KNOWN_HOSTS","item":"Hetzner App Server makepad","field":"known_hosts"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_REMOTE_DIR","item":"PostgreSQL · shared Swarm deployment","field":"DEPLOY_REMOTE_DIR"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_STACK_NAME","item":"PostgreSQL · shared Swarm deployment","field":"DEPLOY_STACK_NAME"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_CATWLK_DB_NETWORK","item":"PostgreSQL · shared Swarm deployment","field":"DEPLOY_CATWLK_DB_NETWORK"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_LE_PETIT_COIN_DB_NETWORK","item":"Le Petit Coin GitHub Deploy Secrets","field":"DEPLOY_DB_NETWORK"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_VIF_DB_NETWORK","item":"PostgreSQL · shared Swarm deployment","field":"DEPLOY_VIF_DB_NETWORK"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_VIF_DB_NAME","item":"PostgreSQL · shared Swarm deployment","field":"DEPLOY_VIF_DB_NAME"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_VIF_DB_USER","item":"PostgreSQL · shared Swarm deployment","field":"DEPLOY_VIF_DB_USER"},
+    {"environment":"production","kind":"secret","requirement":"required","destination":"DEPLOY_VIF_DB_PASSWORD","item":"PostgreSQL · shared Swarm deployment","field":"DEPLOY_VIF_DB_PASSWORD"},
+
+    {"environment":"staging-brio-identity-db","kind":"secret","requirement":"required","destination":"BRIO_IDENTITY_DB_DEPLOY_SSH_HOST","item":"Hetzner Database Server makepad","field":"DEPLOY_SSH_HOST"},
+    {"environment":"staging-brio-identity-db","kind":"secret","requirement":"required","destination":"BRIO_IDENTITY_DB_DEPLOY_SSH_PORT","item":"Hetzner Database Server makepad","field":"DEPLOY_SSH_PORT"},
+    {"environment":"staging-brio-identity-db","kind":"secret","requirement":"required","destination":"BRIO_IDENTITY_DB_DEPLOY_SSH_USER","item":"Hetzner Database Server makepad","field":"DEPLOY_SSH_USER"},
+    {"environment":"staging-brio-identity-db","kind":"secret","requirement":"required","destination":"BRIO_IDENTITY_DB_DEPLOY_SSH_PRIVATE_KEY","item":"Hetzner Database Server makepad","field":"DEPLOY_SSH_PRIVATE_KEY"},
+    {"environment":"staging-brio-identity-db","kind":"secret","requirement":"required","destination":"BRIO_IDENTITY_DB_DEPLOY_SSH_KNOWN_HOSTS","item":"Hetzner Database Server makepad","field":"DEPLOY_SSH_KNOWN_HOSTS"},
+    {"environment":"staging-brio-identity-db","kind":"secret","requirement":"required","destination":"KEYCLOAK_BRIO_STAGING_DB_PASSWORD","item":"Brio Staging - PostgreSQL","field":"KEYCLOAK_BRIO_STAGING_DB_PASSWORD"},
+    {"environment":"staging-brio-identity-db","kind":"secret","requirement":"required","destination":"KEYCLOAK_BRIO_STAGING_BACKUP_DB_PASSWORD","item":"Brio Staging - PostgreSQL","field":"KEYCLOAK_BRIO_STAGING_BACKUP_DB_PASSWORD"},
+    {"environment":"staging-brio-identity-db","kind":"secret","requirement":"required","destination":"BRIO_BACKUP_RECIPIENT_CERT_PEM","item":"Brio Staging - PKI and Backup Keys","field":"BRIO_BACKUP_RECIPIENT_CERT_PEM"},
+    {"environment":"staging-brio-identity-db","kind":"variable","requirement":"required","destination":"BRIO_IDENTITY_DB_HOSTNAME","item":"Brio Staging - PKI and Backup Keys","field":"BRIO_IDENTITY_DB_HOSTNAME"},
+    {"environment":"staging-brio-identity-db","kind":"variable","requirement":"required","destination":"BRIO_KEYCLOAK_DB_SOURCE_CIDR","item":"Brio Staging - PKI and Backup Keys","field":"BRIO_KEYCLOAK_DB_SOURCE_CIDR"},
+
+    {"environment":"release-brio-identity-db","kind":"secret","requirement":"required","destination":"KEYCLOAK_RELEASE_ORCHESTRATOR_TOKEN","item":"PostgreSQL · Brio identity release orchestrator","field":"KEYCLOAK_RELEASE_ORCHESTRATOR_TOKEN"},
+
+    {"environment":"keycloak-cohort-restore","kind":"secret","requirement":"required","destination":"KEYCLOAK_COHORT_SOURCE_TOKEN","item":"PostgreSQL · Keycloak cohort source reader","field":"KEYCLOAK_COHORT_SOURCE_TOKEN"},
+    {"environment":"keycloak-cohort-restore","kind":"secret","requirement":"required","destination":"KEYCLOAK_COHORT_DB_SSH_HOST","item":"Hetzner Database Server makepad","field":"DEPLOY_SSH_HOST"},
+    {"environment":"keycloak-cohort-restore","kind":"secret","requirement":"required","destination":"KEYCLOAK_COHORT_DB_SSH_PORT","item":"Hetzner Database Server makepad","field":"DEPLOY_SSH_PORT"},
+    {"environment":"keycloak-cohort-restore","kind":"secret","requirement":"required","destination":"KEYCLOAK_COHORT_DB_SSH_USER","item":"Hetzner Database Server makepad","field":"DEPLOY_SSH_USER"},
+    {"environment":"keycloak-cohort-restore","kind":"secret","requirement":"required","destination":"KEYCLOAK_COHORT_DB_SSH_PRIVATE_KEY","item":"Hetzner Database Server makepad","field":"DEPLOY_SSH_PRIVATE_KEY"},
+    {"environment":"keycloak-cohort-restore","kind":"secret","requirement":"required","destination":"KEYCLOAK_COHORT_DB_SSH_KNOWN_HOSTS","item":"Hetzner Database Server makepad","field":"DEPLOY_SSH_KNOWN_HOSTS"},
+    {"environment":"keycloak-cohort-restore","kind":"secret","requirement":"required","destination":"DHI_REGISTRY_USERNAME","item":"Makepad Docker Hardened Images","field":"DOCKERHUB_USERNAME"},
+    {"environment":"keycloak-cohort-restore","kind":"secret","requirement":"required","destination":"DHI_REGISTRY_PASSWORD","item":"Makepad Docker Hardened Images","field":"DOCKERHUB_PRO_PAT"}
+  ]
+}