Accrue merged PR rewards with manual CoinPay settlement - #9
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| cwd:root,encoding:'utf8',timeout:15000,env:{PATH:process.env.PATH, | ||
| GITHUB_REPOSITORY:'acme/project',GITHUB_EVENT_NAME:comment?'issue_comment':'pull_request_target',GITHUB_EVENT_PATH:path.join(dir,'event.json'),GITHUB_OUTPUT:path.join(dir,'output'), | ||
| 'INPUT_GITHUB-TOKEN':'fixture-github','INPUT_COINPAY-API-KEY':'fixture-scoped-key','INPUT_COINPAY-BUSINESS-ID':'fixture-business', | ||
| ACTIONS_ID_TOKEN_REQUEST_URL:'https://oidc.actions.invalid/token?fixture=true',ACTIONS_ID_TOKEN_REQUEST_TOKEN:'fixture-request-token', |
ThreatCrush Security Scan1 finding(s) LOW: 1
Snippets are redacted; ThreatCrush never prints matched credential material. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Enrolled repositories now record one USD mill ($0.001) per qualifying merged PR. Ten merges earn one nominal cent. Accrual is prospective and idempotent, using the current base-repository PR identity and the deployed portal ledger contract.
Maintainers can inspect accrued, reserved, paid and available amounts with
/coinpay balance, or explicitly reserve whole cents using/coinpay settle --wallet <verified-address> --blockchain USDC_POL. Checkout must be funded manually; a pending link or reservation never implies payment. Existing generic invoice commands remain separate and require their own credential permissions.The reusable workflow handles only merged
pull_request_target: closedevents and authorized PR comments. It freshly checks GitHub identity/permissions, runs an immutable bundle without checking out PR code, and sends a repository-bound contribution key plus audience-bound GitHub OIDC to the fixed CoinPay origin. Consumer secrets use newCOINPAY_CONTRIBUTIONS_*names to preserve existing application credentials.Validation: typecheck, all 292 unit/flow tests, 30 actual workflow-script checks, reproducible bundle build, and nine compiled-Action journeys with real network connections denied. Covers replay, unsafe identities, fork event isolation, current permissions, strict rate/config, exact integer accounting, settlement recipient binding, inactive checkout states and safe transport errors.
Deployment order: deploy the portal ledger and enrollment first, then approve the immutable reusable-workflow pin in the portal and provision the dedicated consumer secrets/config. Source/bundle commit:
f5a6996c43c7a825658a3daa3b0d9343e3bce11f; workflow pin commit:ad7a2bc74f8fbaad424d7c2b2ef82b555a7b7af5. No production ledger writes, comments or payments were made during these offline tests.